🔐 CVE Alert

CVE-2019-25494

HIGH 8.2

Homey BNB V4 SQL Injection Authentication Bypass via Admin Panel

CVSS Score
8.2
EPSS Score
0.0%
EPSS Percentile
0th

Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by injecting SQL syntax into username and password fields. Attackers can submit SQL operators like '=' 'or' in both credentials to manipulate the authentication query and gain unauthorized access to the admin panel.

CWE CWE-89
Vendor doditsolutions
Product homey bnb (airbnb clone script)
Published Feb 27, 2026
Last Updated Apr 7, 2026
Stay Ahead of the Next One

Get instant alerts for doditsolutions homey bnb (airbnb clone script)

Be the first to know when new high vulnerabilities affecting doditsolutions homey bnb (airbnb clone script) are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

Affected Versions

Doditsolutions / Homey BNB (Airbnb Clone Script)
V4

References

NVD ↗ CVE.org ↗ EPSS Data ↗
exploit-db.com: https://www.exploit-db.com/exploits/46616 doditsolutions.com: https://www.doditsolutions.com/airbnb-clone-script/ vulncheck.com: https://www.vulncheck.com/advisories/homey-bnb-sql-injection-authentication-bypass-via-admin-panel

Credits

Ahmet Ümit BAYRAM