Description
Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to getDevicesTotals. The scansource URL parameter is then injected in a SQL query. This vulnerability is fixed in 2026-05-07.
Published: 2026-05-27
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Pi.Alert web interface processes the scansource parameter without adequate validation, enabling unauthenticated blind SQL injection via the devices.php endpoint. This flaw falls under CWE-89 and could allow attackers to retrieve or alter database contents, compromising confidentiality and integrity of network device data.

Affected Systems

Pi.Alert, developed by leiweibau, all releases prior to and including 2026-05-07 are affected. The vulnerability exists from 2024-06-29 until the patch released on 2026-05-07.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. EPSS is not available, so we cannot quantify the current exploitation probability, and the vulnerability is not catalogued in CISA KEV. Based on the description, the likely attack vector is an unauthenticated HTTP request to /pialert/php/server/devices.php with the action set to getDevicesTotals and a crafted scansource value. An attacker with network access can exploit this flaw remotely to query the database and extract or modify sensitive data.

Generated by OpenCVE AI on May 27, 2026 at 20:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Pi.Alert patch released on 2026-05-07 to eliminate the injection flaw.
  • If the patch cannot be applied immediately, block unauthenticated access to /pialert/php/server/devices.php using network controls or firewall rules.
  • Monitor web server logs for repeated requests containing the scansource parameter and other suspicious activity.
  • Consider disabling the devices.php endpoint if it is not required for your deployment, or implement application-layer authorization to restrict access to trusted users.

Generated by OpenCVE AI on May 27, 2026 at 20:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 27 May 2026 19:30:00 +0000

Type Values Removed Values Added
Description Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to getDevicesTotals. The scansource URL parameter is then injected in a SQL query. This vulnerability is fixed in 2026-05-07.
Title Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection
Weaknesses CWE-89
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-05-27T19:16:55.548Z

Reserved: 2026-05-07T21:50:33.545Z

Link: CVE-2026-44886

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-05-27T20:16:37.767

Modified: 2026-05-27T20:16:37.767

Link: CVE-2026-44886

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-27T21:00:14Z

Weaknesses