Vulnerabilities

Filters

2 selected

12 records

Sort

Vendor: yogeshojha Component: Rengine Clear all filters

TI-2024-38384 CVE-2024-58287 · GHSA-c9mq-3m6j-gvhw

reNgine 2.2.0 Authenticated Command Injection via Scan Engine Configuration

HIGH 79

reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd parameter of scan engine configuration that allows authenticated attackers to execute arbitrary commands.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.03423 Published 2025-12-11 No fix listed CWE-78

TI-2025-37986 CVE-2025-61319 · GHSA-2hpc-g4g6-34jm

ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in…

MEDIUM 60

ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00285 Published 2025-10-10 No fix listed CWE-79

TI-2025-18648 CVE-2025-24968

Business Logic And Unrestricted Project Deletion Lead To Take Over the System in reNgine

HIGH 73

reNgine is an automated reconnaissance framework for web applications.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00626 Published 2025-02-04 No fix listed CWE-284

TI-2025-18647 CVE-2025-24967

Stored XSS on Admin Panel When Deleting a User in reNgine

HIGH 66

reNgine is an automated reconnaissance framework for web applications.

CVSS 4.0HIGH 7.4 Network High privileges No interaction EPSS 0.00282 Published 2025-02-04 No fix listed CWE-79

TI-2025-18646 CVE-2025-24966

HTML Injection in reNgine

MEDIUM 63

reNgine is an automated reconnaissance framework for web applications.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0027 Published 2025-02-04 No fix listed CWE-79

TI-2025-18601 CVE-2025-24899

Disclosure of Sensitive User Information via API in reNgine

HIGH 66

reNgine is an automated reconnaissance framework for web applications.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00536 Published 2025-02-03 Fixed in 2.2.0 CWE-200

TI-2025-18642 CVE-2025-24962

Command Injection in reNgine

HIGH 73

reNgine is an automated reconnaissance framework for web applications.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00737 Published 2025-02-03 No fix listed CWE-74

TI-2024-29030 CVE-2024-43381

reNgine vulnerable to Stored Cross-Site Scripting (XSS) via DNS Record Poisoning

MEDIUM 58

reNgine is an automated reconnaissance framework for web applications.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00442 Published 2024-08-16 No fix listed CWE-79

TI-2023-27385 CVE-2023-50094 · GHSA-vfhc-4q79-wvf9

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID.

HIGH 73

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.1354 Published 2024-01-01 No fix listed CWE-78

TI-2022-16879 CVE-2022-36566 · GHSA-7vp8-gh8h-w2rh

Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function.

MEDIUM 46

Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02088 Published 2022-08-31 No fix listed CWE-78

TI-2022-11575 CVE-2022-28995 · GHSA-7jvv-wmf2-38fv

Rengine v1.0.2 was discovered to contain a remote code execution (RCE) vulnerability via…

MEDIUM 47

Rengine v1.0.2 was discovered to contain a remote code execution (RCE) vulnerability via the yaml configuration function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02453 Published 2022-05-20 No fix listed

TI-2021-16190 CVE-2021-38606 · GHSA-rggj-cc94-9fxq

reNgine through 0.5 relies on a predictable directory name.

MEDIUM 44

reNgine through 0.5 relies on a predictable directory name.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01202 Published 2021-08-12 No fix listed CWE-330