Vulnerabilities

Filters

1 selected

15 records

Sort

Vendor: yogeshojha Clear all filters

TI-2026-68321 CVE-2026-105487 · GHSA-xq3c-62mv-qrj4

OS command injection in reNgine listTargets endpoint

MEDIUM 57

A vulnerability was found in yogeshojha reNgine up to 2.2.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01089 Published 2026-10-06 No fix listed CWE-77

TI-2026-62429 CVE-2026-92570 · GHSA-29ch-4262-w3fr

reNgine through 2.2.0 Unauthorized Configuration File Read

MEDIUM 64

reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recon tool configuration files.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00436 Published 2026-09-16 No fix listed CWE-862

TI-2024-38384 CVE-2024-58287 · GHSA-c9mq-3m6j-gvhw

reNgine 2.2.0 Authenticated Command Injection via Scan Engine Configuration

HIGH 79

reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd parameter of scan engine configuration that allows authenticated attackers to execute arbitrary commands.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.03423 Published 2025-12-11 No fix listed CWE-78

TI-2025-37986 CVE-2025-61319 · GHSA-2hpc-g4g6-34jm

ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in…

MEDIUM 60

ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00285 Published 2025-10-10 No fix listed CWE-79

TI-2025-18648 CVE-2025-24968

Business Logic And Unrestricted Project Deletion Lead To Take Over the System in reNgine

HIGH 73

reNgine is an automated reconnaissance framework for web applications.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00626 Published 2025-02-04 No fix listed CWE-284

TI-2025-18647 CVE-2025-24967

Stored XSS on Admin Panel When Deleting a User in reNgine

HIGH 66

reNgine is an automated reconnaissance framework for web applications.

CVSS 4.0HIGH 7.4 Network High privileges No interaction EPSS 0.00282 Published 2025-02-04 No fix listed CWE-79

TI-2025-18646 CVE-2025-24966

HTML Injection in reNgine

MEDIUM 63

reNgine is an automated reconnaissance framework for web applications.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0027 Published 2025-02-04 No fix listed CWE-79

TI-2025-18601 CVE-2025-24899

Disclosure of Sensitive User Information via API in reNgine

HIGH 66

reNgine is an automated reconnaissance framework for web applications.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00536 Published 2025-02-03 Fixed in 2.2.0 CWE-200

TI-2025-18642 CVE-2025-24962

Command Injection in reNgine

HIGH 73

reNgine is an automated reconnaissance framework for web applications.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00737 Published 2025-02-03 No fix listed CWE-74

TI-2024-29030 CVE-2024-43381

reNgine vulnerable to Stored Cross-Site Scripting (XSS) via DNS Record Poisoning

MEDIUM 58

reNgine is an automated reconnaissance framework for web applications.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00442 Published 2024-08-16 No fix listed CWE-79

TI-2023-27385 CVE-2023-50094 · GHSA-vfhc-4q79-wvf9

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID.

HIGH 73

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.1354 Published 2024-01-01 No fix listed CWE-78

TI-2022-16879 CVE-2022-36566 · GHSA-7vp8-gh8h-w2rh

Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function.

MEDIUM 46

Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02088 Published 2022-08-31 No fix listed CWE-78

TI-2022-01679 CVE-2022-1813 · GHSA-62j3-37pc-h32g

OS Command Injection in yogeshojha/rengine

MEDIUM 47

OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0254 Published 2022-05-22 Fixed in 1.2.0 CWE-78

TI-2022-11575 CVE-2022-28995 · GHSA-7jvv-wmf2-38fv

Rengine v1.0.2 was discovered to contain a remote code execution (RCE) vulnerability via…

MEDIUM 47

Rengine v1.0.2 was discovered to contain a remote code execution (RCE) vulnerability via the yaml configuration function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02453 Published 2022-05-20 No fix listed

TI-2021-16190 CVE-2021-38606 · GHSA-rggj-cc94-9fxq

reNgine through 0.5 relies on a predictable directory name.

MEDIUM 44

reNgine through 0.5 relies on a predictable directory name.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01202 Published 2021-08-12 No fix listed CWE-330