CVE-2019-25494

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-25494
Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by injecting SQL syntax into username and password fields. Attackers can submit SQL operators like '=' 'or' in both credentials to manipulate the authentication query and gain unauthorized access to the admin panel.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.doditsolutions.com/airbnb-clone-script/ Product
https://www.exploit-db.com/exploits/46616 Exploit VDB Entry
https://www.vulncheck.com/advisories/homey-bnb-sql-injection-authentication-bypass-via-admin-panel Broken Link
Configurations

Configuration 1 (hide)

cpe:2.3:a:doditsolutions:airbnb_clone_script:4:*:*:*:*:*:*:*
History

13 Mar 2026, 14:37

Type Values Removed Values Added
First Time Doditsolutions airbnb Clone Script
Doditsolutions
CPE cpe:2.3:a:doditsolutions:airbnb_clone_script:4:*:*:*:*:*:*:*
Summary
  • (es) Homey BNB V4 contiene una vulnerabilidad de inyección SQL en el inicio de sesión del panel de administración que permite a atacantes no autenticados eludir la autenticación inyectando sintaxis SQL en los campos de nombre de usuario y contraseña. Los atacantes pueden enviar operadores SQL como '=' 'o' en ambas credenciales para manipular la consulta de autenticación y obtener acceso no autorizado al panel de administración.
References () https://www.doditsolutions.com/airbnb-clone-script/ - () https://www.doditsolutions.com/airbnb-clone-script/ - Product
References () https://www.exploit-db.com/exploits/46616 - () https://www.exploit-db.com/exploits/46616 - Exploit, VDB Entry
References () https://www.vulncheck.com/advisories/homey-bnb-sql-injection-authentication-bypass-via-admin-panel - () https://www.vulncheck.com/advisories/homey-bnb-sql-injection-authentication-bypass-via-admin-panel - Broken Link

27 Feb 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-27 18:16

Updated : 2026-03-13 14:37

NVD link : CVE-2019-25494

Mitre link : CVE-2019-25494

CVE.ORG link : CVE-2019-25494

JSON object : View

Products Affected

doditsolutions

  • airbnb_clone_script
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')