CVE-2026-44886

Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection

View on CVE.org
Published May 27, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to getDevicesTotals. The scansource URL parameter is then injected in a SQL query. This vulnerability is fixed in 2026-05-07.

Analysis

AI-generated

Technical impact

The Pi.Alert web interface processes the scansource parameter without adequate validation, enabling unauthenticated blind SQL injection via the devices.php endpoint. This flaw falls under CWE-89 and could allow attackers to retrieve or alter database contents, compromising confidentiality and integrity of network device data.

Affected Systems

Pi.Alert, developed by leiweibau, all releases prior to and including 2026-05-07 are affected. The vulnerability exists from 2024-06-29 until the patch released on 2026-05-07.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. EPSS is not available, so we cannot quantify the current exploitation probability, and the vulnerability is not catalogued in CISA KEV. Based on the description, the likely attack vector is an unauthenticated HTTP request to /pialert/php/server/devices.php with the action set to getDevicesTotals and a crafted scansource value. An attacker with network access can exploit this flaw remotely to query the database and extract or modify sensitive data.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Pi.Alert patch released on 2026-05-07 to eliminate the injection flaw.
  • If the patch cannot be applied immediately, block unauthenticated access to /pialert/php/server/devices.php using network controls or firewall rules.
  • Monitor web server logs for repeated requests containing the scansource parameter and other suspicious activity.
  • Consider disabling the devices.php endpoint if it is not required for your deployment, or implement application-layer authorization to restrict access to trusted users.

Generated by OpenCVE AI on May 27, 2026 at 20:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Leiweibau
Leiweibau pi.alert
Vendors & Products Leiweibau
Leiweibau pi.alert
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to getDevicesTotals. The scansource URL parameter is then injected in a SQL query. This vulnerability is fixed in 2026-05-07.
Title Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection
Weaknesses CWE-89
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Jul 20, 2026, 5:31 PM
Reserved
May 7, 2026, 9:50 PM

View source JSON

Updated
May 28, 2026, 1:48 PM

JSON

Status
Deferred
Published
May 27, 2026, 8:16 PM
Modified
Oct 26, 2026, 11:10 AM

View source JSON

No data.

Updated
May 29, 2026, 3:50 PM

JSON