---
id: 3713
title: "[CVE-2026-44886] Pi.Alert - Unauthenticated SQL Injection"
cve: CVE-2026-44886
source_domain: projectblack.io
source_url: "https://projectblack.io/blog/pi-alert-unauthenticated-sql-injection/"
published_at: "2026-06-14 07:32"
tags: ["vulnerability-research", "sql-injection", "vulnerability-disclosure", "pi-alert", "cve-2026-44886", "unauthenticated"]
phying_url: "https://phying.com/item/3713"
lang: en
---

# [CVE-2026-44886] Pi.Alert - Unauthenticated SQL Injection

## Summary

Pi.Alert has an unauthenticated SQL injection (CVE-2026-44886): an unsanitised scansource parameter lets attackers dump the whole database. Covers the code flow and a sqlmap proof of concept.

## Intelligence Metadata

- **Sources:** projectblack.io
- **CVE:** CVE-2026-44886
- **Published:** 2026-06-14 07:32
- **Original:** https://projectblack.io/blog/pi-alert-unauthenticated-sql-injection/
- **Phying News:** https://phying.com/item/3713