Which versions of Pixa Bank are affected by CVE-2026-49491?

Pixa Bank 2.0 contains an unauthenticated SQL injection vulnerability enabling attackers to directly exfiltrate customer database contents from any internet-exposed system.

Is there a public PoC exploit available for CVE-2026-49491?

Yes, a public proof-of-concept exploit is available for CVE-2026-49491. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-49491?

24 hours: Inventory all Pixa Bank 2.0 deployments; restrict internet access to agence-ajax.php or take systems offline. 7 days: Monitor vendor advisory for security patch release; establish testing environment for deployment. 30 days: Deploy vendor security patch to all affected systems and conduct comprehensive database access control audit.

Pixa Bank CVE-2026-49491

Q: What is the CVSS score of CVE-2026-49491?

CVE-2026-49491 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-33764 HIGH

SQL Injection (CWE-89)

2026-06-01 VulnCheck

GHSA-w2ff-cx7w-3pwf

PHP Information Disclosure SQLi Pixa Bank

8.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 01, 2026 - 22:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 01, 2026 - 22:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 01, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Jun 01, 2026 - 22:22 NVD

8.2 (HIGH) 8.8 (HIGH)

Analysis Generated

Jun 01, 2026 - 22:16 vuln.today

DescriptionCVE.org

Pixa Bank 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to extract sensitive data by injecting SQL code into the 'rib' parameter. Attackers can send POST requests to the agence-ajax.php endpoint with UNION-based SQL payloads to retrieve user information including names, email addresses, and phone numbers from the database.

AnalysisAI

Unauthenticated SQL injection in Pixa Bank 2.0 allows remote attackers to exfiltrate database contents by submitting UNION-based payloads in the 'rib' parameter of the agence-ajax.php endpoint. Publicly available exploit code exists (Packet Storm) and the issue was disclosed by VulnCheck, making opportunistic exploitation likely against any internet-exposed instance. No public exploit identified at time of analysis as actively exploited in the wild (not on CISA KEV), but the trivial attack complexity and existing PoC elevate practical risk.

Technical ContextAI

Pixa Bank by Pixa Studio is a PHP-based banking/finance web application (cpe:2.3:a:pixastudio:pixa_bank). The flaw is a classic CWE-89 Improper Neutralization of Special Elements used in an SQL Command, where user-supplied input to the 'rib' POST parameter on agence-ajax.php is concatenated into a backend SQL query without parameterization or input sanitization. Because the injection point supports UNION-based extraction, the underlying query is a SELECT that returns data to the response, letting an attacker append additional columns from arbitrary tables - a hallmark of inline string-built SQL in legacy PHP/MySQL stacks.

RemediationAI

No vendor-released patch identified at time of analysis; consult Pixa Studio at https://pixastudio.com/ and the VulnCheck advisory at https://www.vulncheck.com/advisories/pixa-bank-sql-injection-via-agence-ajax-php-api for an official fix. Until a patched release is published, replace the vulnerable SQL construction in agence-ajax.php with parameterized queries (PDO prepared statements or mysqli with bound parameters) on the 'rib' parameter, and add server-side input validation that constrains 'rib' to the expected RIB account-number format (digits/length) - note this is a code change that requires a hotfix deployment. As compensating controls, place a WAF rule in front of agence-ajax.php that blocks SQL meta-characters and the keywords UNION/SELECT/SLEEP in the 'rib' field (trade-off: may break legitimate requests containing unusual characters), restrict access to agence-ajax.php to authenticated session cookies via web server ACLs or .htaccess (side effect: breaks any anonymous front-end flows that rely on this endpoint), and enable database query logging with alerts on UNION patterns to detect exploitation attempts. Rotate any credentials, tokens, or PII previously stored in the database, as data may already be exposed.