Approved changes feed: RSS · Atom
cpe:2.3:a:leiweibau:pi.alert:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Leiweibau (11dfee66-b238-50ed-aff9-b3b6d51072b0) |
|---|---|
| Product | Pi.Alert (da0d3317-bc15-58ce-95bf-7e04ae832902) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-44888 |
vulnerable | 2026-06-08 08:05:11.366275 |
Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Interger)
CRITICAL (9.8)
Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's SaveConfigFile() endpoint writes user-supplied numeric config values (e.g., SMTP_PORT) directly into
pialert.conf without validation. Since pialert.conf is loaded via Python's exec() every 3–5 minutes by the
background cron process, an attacker can inject arbitrary Python code and achieve unauthenticated OS-level RCE. On
default installations (PIALERT_WEB_PROTECTION = False), no credentials are required. This vulnerability is fixed in 2026-05-07.
Published: 2026-05-27T19:14:43.897Z
Updated: 2026-05-28T13:23:20.875Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44887 |
vulnerable | 2026-06-08 08:05:11.366129 |
Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Path)
CRITICAL (9.8)
Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's web-based configuration editor allows arbitrary Python code to be injected into pialert.conf. Since the background scan daemon loads this file via Python's exec(), injected code executes as the daemon process. With web protection disabled (the default configuration), no authentication is required, making this an unauthenticated Remote Code Execution vulnerability. This vulnerability is fixed in 2026-05-07.
Published: 2026-05-27T19:15:27.995Z
Updated: 2026-05-28T12:58:28.870Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44886 |
vulnerable | 2026-06-08 08:05:11.365929 |
Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection
Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to getDevicesTotals. The scansource URL parameter is then injected in a SQL query. This vulnerability is fixed in 2026-05-07.
Published: 2026-05-27T19:16:55.548Z
Updated: 2026-07-20T17:31:22.459Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.