CVE-2024-43381: medium-severity vulnerability in yogeshojha rengine
reNgine vulnerable to Stored Cross-Site Scripting (XSS) via DNS Record Poisoning
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5epss 0.4%
reNgine is an automated reconnaissance framework for web applications. Versions 2.1.2 and prior are susceptible to Stored Cross-Site Scripting (XSS) attacks. This vulnerability occurs when scanning a domain, and if the target domain's DNS record contains an XSS payload, it leads to the execution of malicious scripts in the reNgine's dashboard view when any user views the scan results. The XSS payload is directly fetched from the DNS record of the remote target domain. Consequently, an attacker can execute the attack without requiring any additional input from the target or the reNgine user. A patch is available and expected to be part of version 2.1.3.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected products
yogeshojha · rengineRelated CVEs — yogeshojha rengine
In the same product, most dangerous first.
CVE-2025-24962HIGHCommand Injection in reNgineEPSS 0.8%CVE-2025-24968HIGHBusiness Logic And Unrestricted Project Deletion Lead To Take Over the System in reNgineEPSS 0.6%CVE-2025-24899HIGHDisclosure of Sensitive User Information via API in reNgineEPSS 0.5%CVE-2026-92570HIGHreNgine through 2.2.0 Unauthorized Configuration File ReadEPSS 0.4%CVE-2025-24967HIGHStored XSS on Admin Panel When Deleting a User in reNgineEPSS 0.3%CVE-2025-24966MEDIUMHTML Injection in reNgineEPSS 0.3%