yogeshojha vulnerabilities and exploits

(subscribe to this query)

reNgine prior to 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.

Yogeshojha Rengine

1 Github repository

reNgine up to and including 0.5 relies on a predictable directory name.

Yogeshojha Rengine

reNgine is an automated reconnaissance framework for web applications. Versions 2.1.2 and prior are susceptible to Stored Cross-Site Scripting (XSS) attacks. This vulnerability occurs when scanning a domain, and if the target domain's DNS record contains an XSS payload, it l...

Yogeshojha Rengine

Rengine v1.0.2 exists to contain a remote code execution (RCE) vulnerability via the yaml configuration function.

Yogeshojha Rengine 1.0.2

Rengine v1.3.0 exists to contain a command injection vulnerability via the scan engine function.

Yogeshojha Rengine 1.3.0

reNgine is an automated reconnaissance framework for web applications. A vulnerability exists in reNgine, where **an insider attacker with any role** (such as Auditor, Penetration Tester, or Sys Admin) **can extract sensitive information from other reNgine users.** After running ...

Yogeshojha Rengine

reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmap_cmd parameters. This issue has been addressed in commit `c28e5c8d` and is expected in the next versioned release. Users are advised to filter user i...

Yogeshojha Rengine

reNgine is an automated reconnaissance framework for web applications. HTML Injection occurs when an application improperly validates or sanitizes user inputs, allowing malicious users to inject arbitrary HTML code. In this scenario, the vulnerability exists in the "Add Targ...

Yogeshojha Rengine

reNgine is an automated reconnaissance framework for web applications. A stored cross-site scripting (XSS) vulnerability exists in the admin panel's user management functionality. An attacker can exploit this issue by injecting malicious payloads into the username field duri...

Yogeshojha Rengine

reNgine is an automated reconnaissance framework for web applications. An unrestricted project deletion vulnerability allows attackers with specific roles, such as `penetration_tester` or `auditor` to delete all projects in the system. This can lead to a complete system takeover ...

Yogeshojha Rengine

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook