PT-2025-5609 · Rengine · Rengine

Ayushsinha30 · Published 2025-02-04 · Updated 2025-05-13 · CVE-2025-24966

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: reNgine versions up to and including 2.2.0

Description: The issue occurs due to improper validation or sanitization of user inputs in the "Add Target" functionality, allowing attackers to inject arbitrary HTML code. The injected HTML is rendered and executed in the target area, potentially leading to malicious actions. This can compromise the application's integrity and user trust, allowing attackers to execute unauthorized actions, steal sensitive information, or trick users into performing harmful actions. The organization's reputation, customer trust, and regulatory compliance could be negatively affected.

Recommendations: For versions up to and including 2.2.0, users are advised to monitor the project for future releases which address this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-24966

GHSA-4PHC-M2WM-P8X6

Affected Products

Rengine

References · 8

• 🔥 https://github.com/yogeshojha/rengine/security/advisories/GHSA-4phc-m2wm-p8x6 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24966.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-24966 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24966 · Security Note
• https://twitter.com/CVEnew/status/1886861323285283130 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1887027643066769497 · Twitter Post
• https://t.me/cvenotify/122026 · Telegram Post
• https://t.me/cvedetector/17231 · Telegram Post