CVE-2026-49491 is an SQL injection vulnerability in Pixa Bank 2.0 where the 'rib' parameter is improperly neutralized, enabling attackers to inject malicious SQL code. By sending crafted POST requests to the agence-ajax.php endpoint with UNION-based payloads, attackers can retrieve sensitive user information from the backend database. The vulnerability has a CVSS 4.0 base score of 8.8, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

Successful exploitation allows unauthenticated remote attackers to extract sensitive user data including names, email addresses, and phone numbers from the Pixa Bank database. This compromises user privacy and could facilitate further attacks such as identity theft or phishing. There is no indication of privilege escalation or availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint or implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'rib' parameter. Monitor vendor channels for updates and apply patches promptly once released.