CVE-2026-44886

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44886", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T21:50:33.545Z", "datePublished": "2026-05-27T19:16:55.548Z", "dateUpdated": "2026-07-20T17:31:22.459Z"}, "containers": {"cna": {"title": "Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/leiweibau/Pi.Alert/security/advisories/GHSA-m929-j7w8-334j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/leiweibau/Pi.Alert/security/advisories/GHSA-m929-j7w8-334j"}, {"name": "https://projectblack.io/blog/pi-alert-unauthenticated-sql-injection", "tags": ["x_refsource_MISC"], "url": "https://projectblack.io/blog/pi-alert-unauthenticated-sql-injection"}], "affected": [{"vendor": "leiweibau", "product": "Pi.Alert", "versions": [{"version": ">= 2024-06-29, < 2026-05-07", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T17:31:22.459Z"}, "descriptions": [{"lang": "en", "value": "Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to getDevicesTotals. The scansource URL parameter is then injected in a SQL query. This vulnerability is fixed in 2026-05-07."}], "source": {"advisory": "GHSA-m929-j7w8-334j", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/leiweibau/Pi.Alert/security/advisories/GHSA-m929-j7w8-334j", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-28T13:45:01.324823Z", "id": "CVE-2026-44886", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T13:49:07.413Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44886", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T13:45:01.324823Z"}}}], "references": [{"url": "https://github.com/leiweibau/Pi.Alert/security/advisories/GHSA-m929-j7w8-334j", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T13:48:55.682Z"}}], "cna": {"title": "Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection", "source": {"advisory": "GHSA-m929-j7w8-334j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "leiweibau", "product": "Pi.Alert", "versions": [{"status": "affected", "version": ">= 2024-06-29, < 2026-05-07"}]}], "references": [{"url": "https://github.com/leiweibau/Pi.Alert/security/advisories/GHSA-m929-j7w8-334j", "name": "https://github.com/leiweibau/Pi.Alert/security/advisories/GHSA-m929-j7w8-334j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://projectblack.io/blog/pi-alert-unauthenticated-sql-injection", "name": "https://projectblack.io/blog/pi-alert-unauthenticated-sql-injection", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to getDevicesTotals. The scansource URL parameter is then injected in a SQL query. This vulnerability is fixed in 2026-05-07."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T17:31:22.459Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44886", "state": "PUBLISHED", "dateUpdated": "2026-07-20T17:31:22.459Z", "dateReserved": "2026-05-07T21:50:33.545Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-27T19:16:55.548Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Pi.Alert", "vendor": "leiweibau", "versions": [{"status": "affected", "version": ">= 2024-06-29, < 2026-05-07"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to getDevicesTotals. The scansource URL parameter is then injected in a SQL query. This vulnerability is fixed in 2026-05-07."}, {"lang": "es", "value": "Pi.Alert es un detector de intrusos WIFI / LAN con monitoreo de servicios web. Desde 29-06-2024 hasta antes de 07-05-2026, el endpoint de la aplicaci\u00f3n web es vulnerable a inyecci\u00f3n SQL. La ruta /pialert/PHP/servidor/devices.PHP acepta solicitudes de usuarios no autenticados cuando el par\u00e1metro URL action est\u00e1 configurado como getDevicesTotals. El par\u00e1metro URL scansource es entonces inyectado en una consulta SQL. Esta vulnerabilidad se corrige el 07-05-2026."}], "id": "CVE-2026-44886", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44886", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-28T13:45:01.324823Z", "version": "2.0.3"}}]}, "published": "2026-05-27T20:16:37.767", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/leiweibau/Pi.Alert/security/advisories/GHSA-m929-j7w8-334j"}, {"source": "security-advisories@github.com", "url": "https://projectblack.io/blog/pi-alert-unauthenticated-sql-injection"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/leiweibau/Pi.Alert/security/advisories/GHSA-m929-j7w8-334j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2024-06-29,2026-05-07)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Pi.Alert", "source": "cna", "vendor": "leiweibau"}, "product": "pi.alert", "vendor": "leiweibau"}], "created": "2026-05-27T21:00:14.894253+00:00", "updated": "2026-05-29T15:50:17.731354+00:00", "vendors": ["leiweibau", "leiweibau$PRODUCT$pi.alert"]}