PT-2026-44074 · Pi.Alert · Pi.Alert

Jarrodcameron

·

CVE-2026-44886

·

Published

2026-05-27

·

Updated

2026-07-20

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Pi.Alert versions prior to 2026-05-07
Description Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. The web application endpoint '/pialert/php/server/devices.php' allows unauthenticated users to perform SQL injection when the action URL parameter is set to 'getDevicesTotals'. The scansource URL parameter is then injected into a SQL query.
Recommendations Update to the version released on 2026-05-07. Avoid using the scansource parameter in the '/pialert/php/server/devices.php' endpoint until the update is applied.

Exploit

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-44886
GHSA-M929-J7W8-334J

Affected Products

Pi.Alert