CVE-2025-24899

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where **an insider attacker with any role** (such as Auditor, Penetration Tester, or Sys Admin) **can extract sensitive information from other reNgine users.** After running a scan and obtaining vulnerabilities from a target, the attacker can retrieve details such as `username`, `password`, `email`, `role`, `first name`, `last name`, `status`, and `activity information` by making a GET request to `/api/listVulnerability/`. This issue has been addressed in version 2.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Feb 3, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-24905.4A vulnerability was found in Dromara ujcms 9.7.5. It has been rated as problematic. Affected by this issue is the function uploadZip/upload CVE-2025-249008.6Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Due to a lack of CSRF countermeasures and imprCVE-2025-249018.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `deletar_permissaCVE-2025-249028.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_cargo.phpCVE-2025-249038.5libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with SigCVE-2025-249048.5libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with SigCVE-2025-249059.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_codigobarrasCVE-2025-249069.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_cobCVE-2025-249076.8Overview   The product uses external input to construct a pathname that should be within a restricted directory, but it does not propCVE-2025-249086.8Overview   The product uses external input to construct a pathname that should be within a restricted directory, but it does not propCVE-2025-249094.4Overview   The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is uCVE-2025-24915.4A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5. This affects the function update of the file /main/java/com