High severityNVD Advisory· Published May 27, 2026· Updated Jul 20, 2026

CVE-2026-44886

Description

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to getDevicesTotals. The scansource URL parameter is then injected in a SQL query. This vulnerability is fixed in 2026-05-07.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Leiweibau/Pi.alertinferred
Range: >=2024-06-29,<2026-05-07
Pi.alert Project/Pi.alertllm-fuzzy
Range: <2026-05-07

Patches

Vulnerability mechanics

References

github.com/leiweibau/Pi.Alert/security/advisories/GHSA-m929-j7w8-334jnvd
projectblack.io/blog/pi-alert-unauthenticated-sql-injectionnvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000