VULNERABILITY INTELLIGENCE

CVE-2019-25490

CVSS score8.8 HIGH

EPSS probability0.37%

CISA KEVNot currently listed

Published2026-02-27

Last modified2026-06-17

Description

Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' parameter. Attackers can send GET requests to the admin/edit.php endpoint with time-based SQL injection payloads to extract sensitive database information.