What is the CVSS score of CVE-2019-25489?

CVE-2019-25489 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Airbnb Clone Script are affected by CVE-2019-25489?

CVE-2019-25489 is a critical SQL injection vulnerability affecting Homey BNB V4 that allows unauthenticated attackers to directly manipulate the application's database without credentials.

Is there a public PoC exploit available for CVE-2019-25489?

Yes, a public proof-of-concept exploit is available for CVE-2019-25489. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2019-25489?

Within 24 hours: Identify all instances of Homey BNB V4 in your environment and take inventory of connected databases. Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the hosting_id parameter and restrict access to the application via network controls if non-critical. Within 7 days: Conduct a forensic audit of database access logs and query histories to detect any unauthorized access or data exfiltration. Evaluate whether the application can be safely disabled pending remediation. Within 30 days: Contact the vendor for patch availability or timeline; if unavailable, plan migration to alternative solutions or implement comprehensive input validation/parameterized queries through custom code patching if feasible.

Airbnb Clone Script CVE-2019-25489

HIGH

SQL Injection (CWE-89)

2026-02-27 disclosure@vulncheck.com

Denial Of Service SQLi Airbnb Clone Script Doditsolutions

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 06, 2026 - 20:56 vuln.today

Public exploit code

CVE Published

Feb 27, 2026 - 18:16 nvd

HIGH 8.2

DescriptionCVE.org

Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the hosting_id parameter. Attackers can send GET requests to the rooms/ajax_refresh_subtotal endpoint with malicious hosting_id values to extract sensitive database information or cause denial of service.

AnalysisAI

Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the hosting_id parameter. [CVSS 8.2 HIGH]

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects the hosting_id component of Airbnb Clone Script. Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the hosting_id parameter. Attackers can send GET requests to the rooms/ajax_refresh_subtotal endpoint with malicious hosting_id values to extract sensitive database information or cause denial of service.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.