CVE-2019-25494

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by injecting SQL syntax into username and password fields. Attackers can submit SQL operators like '=' 'or' in both credentials to manipulate the authentication query and gain unauthorized access to the admin panel.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Feb 27, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2019

CVE-2019-254957.5osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting CVE-2019-254967.5osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting CVE-2019-254977.5osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting CVE-2019-254988.2Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting CVE-2019-254999.8Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting CVE-2019-25504.3Vulnerability in the Oracle FLEXCUBE Direct Banking component of Oracle Financial Services Applications (subcomponent: Logoff Page). The supCVE-2019-255008.2Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting CVE-2019-255018.2Simple Job Script contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting malicious SQL coCVE-2019-255026.1Simple Job Script contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulCVE-2019-255037.1PHPads 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicCVE-2019-255048.2NCrypted Jobgator contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting CVE-2019-255057.1Tradebox 5.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL cod
CVE-2019-25494: High severity, CVSS 8.2 | Vulnix