CVE-2025-24962

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmap_cmd parameters. This issue has been addressed in commit `c28e5c8d` and is expected in the next versioned release. Users are advised to filter user input and monitor the project for a new release.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published
Feb 3, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-249637.5Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on thCVE-2025-249648.8Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious wCVE-2025-249658.5crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handlCVE-2025-249665.4reNgine is an automated reconnaissance framework for web applications. HTML Injection occurs when an application improperly validates or sanCVE-2025-249675.4reNgine is an automated reconnaissance framework for web applications. A stored cross-site scripting (XSS) vulnerability exists in the adminCVE-2025-249688.8reNgine is an automated reconnaissance framework for web applications. An unrestricted project deletion vulnerability allows attackers with CVE-2025-249695.0iTop is an web based IT Service Management tool. Prior to version 3.2.1, a portal user can see any other contacts picture by changing the piCVE-2025-24977.8A maliciously crafted DWG file, when parsed through Autodesk Revit, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actorCVE-2025-249707.5Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to versioCVE-2025-249719.5DumpDrop is a stupid simple file upload application that provides an interface for dragging and dropping files. An OS Command Injection vulnCVE-2025-249724.3Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, inCVE-2025-249739.3Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper