CVE-2025-24899

Date: February 3, 2025

reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where an insider attacker with any role (such as Auditor, Penetration Tester, or Sys Admin) can extract sensitive information from other reNgine users. After running a scan and obtaining vulnerabilities from a target, the attacker can retrieve details such as "username", "password", "email", "role", "first name", "last name", "status", and "activity information" by making a GET request to "/api/listVulnerability/". This issue has been addressed in version 2.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.