High severity · published Feb 27, 2026
CVE-2019-25492
Homey BNB V4 SQL Injection via getcmsdata.php
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pt' parameter. Attackers can send GET requests to the admin/getcmsdata.php endpoint with malicious 'pt' values to extract sensitive database information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HB
Homey BNB (Airbnb Clone Script) · Doditsolutions
V4 · source: vendor
AC
Airbnb Clone Script · Doditsolutions
4 · source: NVD
Affected product
HB
Homey BNB (Airbnb Clone Script)
Doditsolutions
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-25492
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-25492
Product
https://www.doditsolutions.com/airbnb-clone-script/
Exploit
https://www.exploit-db.com/exploits/46616
Broken Link
https://www.vulncheck.com/advisories/homey-bnb-sql-injection-via-getcmsdataphp
More from Homey BNB (Airbnb Clone Script)
9.1
CVE-2019-25489
Homey BNB V4 SQL Injection via ajax_refresh_subtotal
8.2
CVE-2019-25494
Homey BNB V4 SQL Injection Authentication Bypass via Admin Panel
7.5
CVE-2019-25493
Homey BNB V4 SQL Injection via getrecord.php
7.5
CVE-2019-25491
Homey BNB V4 SQL Injection via cms_getpagetitle.php
7.5
CVE-2019-25490
Homey BNB V4 SQL Injection via admin edit.php