High severity · published Feb 27, 2026
CVE-2019-25491
Homey BNB V4 SQL Injection via cms_getpagetitle.php
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the catid parameter. Attackers can send GET requests to the admin/cms_getpagetitle.php endpoint with malicious catid values to extract sensitive database information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HB
Homey BNB (Airbnb Clone Script) · Doditsolutions
V4 · source: vendor
AC
Airbnb Clone Script · Doditsolutions
4 · source: NVD
Affected product
HB
Homey BNB (Airbnb Clone Script)
Doditsolutions
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-25491
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-25491
Product
https://www.doditsolutions.com/airbnb-clone-script/
Exploit
https://www.exploit-db.com/exploits/46616
Broken Link
https://www.vulncheck.com/advisories/homey-bnb-sql-injection-via-cmsgetpagetitlephp
More from Homey BNB (Airbnb Clone Script)
9.1
CVE-2019-25489
Homey BNB V4 SQL Injection via ajax_refresh_subtotal
8.2
CVE-2019-25494
Homey BNB V4 SQL Injection Authentication Bypass via Admin Panel
7.5
CVE-2019-25493
Homey BNB V4 SQL Injection via getrecord.php
7.5
CVE-2019-25492
Homey BNB V4 SQL Injection via getcmsdata.php
7.5
CVE-2019-25490
Homey BNB V4 SQL Injection via admin edit.php