CVE-2026-44886 describes an SQL injection vulnerability in the Pi.Alert product by leiweibau. The vulnerability exists in the /pialert/php/server/devices.php endpoint when the action URL parameter equals getDevicesTotals. The scansource URL parameter is not properly neutralized and is injected directly into a SQL query, allowing unauthenticated remote attackers to execute arbitrary SQL commands. The affected versions are those released from 2024-06-29 until before 2026-05-07. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity. No official remediation level or patch link is provided, but the vulnerability is fixed in the 2026-05-07 release.

Successful exploitation allows unauthenticated remote attackers to perform SQL injection attacks on the Pi.Alert web application, potentially leading to unauthorized data access or manipulation. The vulnerability affects the confidentiality and integrity of the system due to improper neutralization of SQL commands. The high CVSS score reflects the network attack vector, low attack complexity, and no required privileges or user interaction.

The vulnerability is fixed in the Pi.Alert version released on 2026-05-07. Users should upgrade to this version or later to remediate the issue. Since no official patch link or advisory is provided, verify the update availability with the vendor or product source. Until the update is applied, restrict access to the vulnerable endpoint if possible.