High severity · published Feb 27, 2026
CVE-2019-25494
Homey BNB V4 SQL Injection Authentication Bypass via Admin Panel
8.2
CVSS
0.5%
EPSS
No
On KEV
Description
Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by injecting SQL syntax into username and password fields. Attackers can submit SQL operators like '=' 'or' in both credentials to manipulate the authentication query and gain unauthorized access to the admin panel.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HB
Homey BNB (Airbnb Clone Script) · Doditsolutions
V4 · source: vendor
AC
Airbnb Clone Script · Doditsolutions
4 · source: NVD
Affected product
HB
Homey BNB (Airbnb Clone Script)
Doditsolutions
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-25494
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-25494
Product
https://www.doditsolutions.com/airbnb-clone-script/
Exploit
https://www.exploit-db.com/exploits/46616
Broken Link
https://www.vulncheck.com/advisories/homey-bnb-sql-injection-authentication-bypass-via-admin-panel
More from Homey BNB (Airbnb Clone Script)
9.1
CVE-2019-25489
Homey BNB V4 SQL Injection via ajax_refresh_subtotal
7.5
CVE-2019-25493
Homey BNB V4 SQL Injection via getrecord.php
7.5
CVE-2019-25492
Homey BNB V4 SQL Injection via getcmsdata.php
7.5
CVE-2019-25491
Homey BNB V4 SQL Injection via cms_getpagetitle.php
7.5
CVE-2019-25490
Homey BNB V4 SQL Injection via admin edit.php