Vulnerabilidades do Yogeshojha Rengine

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Yogeshojha Rengine: 3 registro(s), com versões afetadas e correções.
cpe:2.3:a:yogeshojha:rengine

CVE-2026-105487 Média · 6.3 CWE-77 05/10/2026

yogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain_discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

CVE-2026-92570 Média · 6.5 CWE-862 16/09/2026

reNgine through 2.2.0 Unauthorized Configuration File Read

reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recon tool configuration files. Attackers with low-privilege Auditor roles can access files containing third-party API keys for services like SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge and Hunter by querying the endpoint without role-based permission checks.

CVE-2024-58287 Alta · 8.8 CWE-78 11/12/2025

reNgine 2.2.0 Authenticated Command Injection via Scan Engine Configuration

reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd parameter of scan engine configuration that allows authenticated attackers to execute arbitrary commands. Attackers can modify the nmap_cmd parameter with malicious base64-encoded payloads to achieve remote code execution during scan engine configuration.