TI-2025-18601 Aliases CVE-2025-24899

Disclosure of Sensitive User Information via API in reNgine

HIGH 66CWE-200Published 2025-02-03 · Updated 2025-02-12

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where **an insider attacker with any role** (such as Auditor, Penetration Tester, or Sys Admin) **can extract sensitive information from other reNgine users.** After running a scan and obtaining vulnerabilities from a target, the attacker can retrieve details such as `username`, `password`, `email`, `role`, `first name`, `last name`, `status`, and `activity information` by making a GET request to `/api/listVulnerability/`. This issue has been addressed in version 2.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00536 45th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed rengine (yogeshojha): 2.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
yogeshojha	rengine	before 2.2.0	2.2.0	Patch available	CNA

rengine Vendoryogeshojha Affected before 2.2.0 Fixed in 2.2.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:yogeshojha:rengine::::::::	before 2.2.0	Vulnerable	yogeshojha

cpe:2.3:a:yogeshojha:rengine:*:*:*:*:*:*:*:* Versions before 2.2.0 Vulnerable ·yogeshojha

Remediation

Fix · CNA rengine (yogeshojha) Fixed in 2.2.0

Timeline

2026-10-02 Threatist record created from CVE-2025-24899

References

Exploit 1

https://github.com/yogeshojha/rengine/security/advisories/GHSA-r3fp-xr9f-wv38

Patch 1

https://github.com/yogeshojha/rengine/commit/a658b8519f1a3347634b04733cf91ed933af1f99

TI-2024-38384 reNgine 2.2.0 Authenticated Command Injection via Scan Engine Configuration CVSS 4.0HIGH 8.7
TI-2025-18648 Business Logic And Unrestricted Project Deletion Lead To Take Over the System in reNgine CVSS 3.1HIGH 8.8
TI-2025-18642 Command Injection in reNgine CVSS 4.0HIGH 8.7
TI-2023-27385 reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. CVSS 3.1HIGH 8.8
TI-2025-18647 Stored XSS on Admin Panel When Deleting a User in reNgine CVSS 4.0HIGH 7.4
TI-2025-18646 HTML Injection in reNgine CVSS 4.0MEDIUM 5.3

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences