Vulnerabilities

TI-2019-15547 CVE-2019-25494 · GHSA-22p3-cw83-672h

Homey BNB V4 SQL Injection Authentication Bypass via Admin Panel

HIGH 77

Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by injecting SQL syntax into username and password fields.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00464 Published 2026-02-27 No fix listed CWE-89

TI-2019-15546 CVE-2019-25493 · GHSA-jw6x-gh8v-8x7w

Homey BNB V4 SQL Injection via getrecord.php

HIGH 77

Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'val' parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00366 Published 2026-02-27 No fix listed CWE-89

TI-2019-15545 CVE-2019-25492 · GHSA-p7f5-m66f-fmfw

Homey BNB V4 SQL Injection via getcmsdata.php

HIGH 77

Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pt' parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00366 Published 2026-02-27 No fix listed CWE-89

TI-2019-15544 CVE-2019-25491 · GHSA-3vq4-2c4v-g9jf

Homey BNB V4 SQL Injection via cms_getpagetitle.php

HIGH 77

Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the catid parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00366 Published 2026-02-27 No fix listed CWE-89

TI-2019-15543 CVE-2019-25490 · GHSA-7vh4-6xxj-cp37

Homey BNB V4 SQL Injection via admin edit.php

HIGH 77

Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00366 Published 2026-02-27 No fix listed CWE-89

TI-2019-15542 CVE-2019-25489 · GHSA-gg87-rfp4-hx5w

Homey BNB V4 SQL Injection via ajax_refresh_subtotal

HIGH 77

Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the hosting_id parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00445 Published 2026-02-27 No fix listed CWE-89

TI-2017-13067 CVE-2017-17830 · GHSA-4ppq-w2fh-jgcq

Bus Booking Script has CSRF via admin/new_master.php.

LOW 30

Bus Booking Script has CSRF via admin/new_master.php.

CVSS 3.0MEDIUM 6.8 Network High privileges User interaction EPSS 0.0044 Published 2017-12-21 No fix listed CWE-352

TI-2017-13066 CVE-2017-17829 · GHSA-98x3-g89g-rj9v

Bus Booking Script has SQL Injection via the admin/view_seatseller.php sp_id parameter or…

LOW 34

Bus Booking Script has SQL Injection via the admin/view_seatseller.php sp_id parameter or the admin/view_member.php memid parameter.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.01023 Published 2017-12-21 No fix listed CWE-89

TI-2017-13065 CVE-2017-17828 · GHSA-769m-v9rr-wqc4

Bus Booking Script has XSS via the results.php datepicker parameter or the admin/new_master.php spemail parameter.

LOW 23

Bus Booking Script has XSS via the results.php datepicker parameter or the admin/new_master.php spemail parameter.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00542 Published 2017-12-21 No fix listed CWE-79

Vulnerabilities

Filters