PT-2026-45617 · Pixastudio · Pixa Bank

Indoushka · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-49491

Mitre

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Pixa Bank 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to extract sensitive data by injecting SQL code into the 'rib' parameter. Attackers can send POST requests to the agence-ajax.php endpoint with UNION-based SQL payloads to retrieve user information including names, email addresses, and phone numbers from the database.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-49491

Affected Products

Pixa Bank

References · 4

• 🔥 https://packetstorm.news/files/id/220748 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-49491 · Security Note
• https://pixastudio.com · Note
• https://vulncheck.com/advisories/pixa-bank-sql-injection-via-agence-ajax-php-api · Note