Rengine
Monthly
reNgine through 2.2.0 allows any authenticated user, including low-privilege Auditor accounts, to read bundled recon-tool configuration files through the GetFileContents API endpoint without role-based permission checks. Those files can contain third-party API keys for SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge, and Hunter, making this an information-disclosure issue rather than remote code execution. No public exploit identified at time of analysis, and successful exploitation requires an authenticated account plus configured integrations to expose meaningful secrets.
Authenticated command injection in reNgine up to 2.2.0 allows a low-privileged user to execute arbitrary OS commands on the server by supplying a crafted target Name, which is passed to a shell command during the subdomain_discovery task. Publicly available exploit code exists (GitHub issue #1561), and the upstream fix PR #1562 awaits acceptance, so no released patched version is confirmed. Independent assessment rates the impact as high (CVSS 3.1: 8.8), while the vendor's CVSS 4.0 score of 2.1 reflects limited scope and low impact ratings, creating a sharp conflict in severity signals; no CISA KEV confirmation was provided.
reNgine is an automated reconnaissance framework for web applications. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
reNgine is an automated reconnaissance framework for web applications. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
reNgine is an automated reconnaissance framework for web applications. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
reNgine is an automated reconnaissance framework for web applications. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
reNgine is an automated reconnaissance framework for web applications. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
reNgine is an automated reconnaissance framework for web applications. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 88.6%.
Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Rengine v1.0.2 was discovered to contain a remote code execution (RCE) vulnerability via the yaml configuration function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
reNgine through 0.5 relies on a predictable directory name. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
reNgine through 2.2.0 allows any authenticated user, including low-privilege Auditor accounts, to read bundled recon-tool configuration files through the GetFileContents API endpoint without role-based permission checks. Those files can contain third-party API keys for SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge, and Hunter, making this an information-disclosure issue rather than remote code execution. No public exploit identified at time of analysis, and successful exploitation requires an authenticated account plus configured integrations to expose meaningful secrets.
Authenticated command injection in reNgine up to 2.2.0 allows a low-privileged user to execute arbitrary OS commands on the server by supplying a crafted target Name, which is passed to a shell command during the subdomain_discovery task. Publicly available exploit code exists (GitHub issue #1561), and the upstream fix PR #1562 awaits acceptance, so no released patched version is confirmed. Independent assessment rates the impact as high (CVSS 3.1: 8.8), while the vendor's CVSS 4.0 score of 2.1 reflects limited scope and low impact ratings, creating a sharp conflict in severity signals; no CISA KEV confirmation was provided.
reNgine is an automated reconnaissance framework for web applications. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
reNgine is an automated reconnaissance framework for web applications. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
reNgine is an automated reconnaissance framework for web applications. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
reNgine is an automated reconnaissance framework for web applications. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
reNgine is an automated reconnaissance framework for web applications. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
reNgine is an automated reconnaissance framework for web applications. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 88.6%.
Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Rengine v1.0.2 was discovered to contain a remote code execution (RCE) vulnerability via the yaml configuration function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
reNgine through 0.5 relies on a predictable directory name. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.