CVE-2026-44886

HighCVSS 8.7/10Last modified Jul 20, 2026

Description

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to getDevicesTotals. The scansource URL parameter is then injected in a SQL query. This vulnerability is fixed in 2026-05-07.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 27, 2026
Last modified
Jul 20, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-448879.8Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's web-based configuration editor allowCVE-2026-448889.8Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's SaveConfigFile() endpoint writes useCVE-2026-448896.1WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is CVE-2026-44898.8A vulnerability was detected in Tenda A18 Pro 02.03.02.28. This vulnerability affects the function form_fast_setting_wifi_set of the file /gCVE-2026-448907.5Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.FinCVE-2026-448917.5Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.CVE-2026-448927.5Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configuCVE-2026-448937.5Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.FCVE-2026-448947.5Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used when tCVE-2026-448959.2GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships with no authenticatCVE-2026-448966.1Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the render_figure(CVE-2026-448976.1Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading() builds the opening <hN> tag by string