Vulnerability Description
Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to getDevicesTotals. The scansource URL parameter is then injected in a SQL query. This vulnerability is fixed in 2026-05-07.
Related Weaknesses (CWE)
References
- https://github.com/leiweibau/Pi.Alert/security/advisories/GHSA-m929-j7w8-334j
- https://projectblack.io/blog/pi-alert-unauthenticated-sql-injection
- https://github.com/leiweibau/Pi.Alert/security/advisories/GHSA-m929-j7w8-334j
FAQ
What is CVE-2026-44886?
CVE-2026-44886 is a documented vulnerability. Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devic...
How severe is CVE-2026-44886?
CVSS scoring is not yet available for CVE-2026-44886. Check NVD for updates.
Is there a patch for CVE-2026-44886?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.