PT-2025-5610 · Rengine · Rengine

Theanm0L · Published 2025-02-04 · Updated 2025-05-13 · CVE-2025-24967

Positive Technologies (AI Summary)

CVSS v4.0

7.4

High

Base vector

AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: reNgine versions prior to 2.20

Description: A stored cross-site scripting (XSS) issue exists in the admin panel's user management functionality, allowing an attacker to inject malicious payloads into the username field during user creation. This enables unauthorized script execution when the admin views or interacts with the affected user entry, posing a significant risk to sensitive admin functionalities.

Recommendations: For versions prior to 2.20, users are advised to monitor the project for future releases that address this issue. As a temporary workaround, consider restricting access to the user management functionality in the admin panel until a patch is available. Avoid using the username field in the affected user management functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-24967

GHSA-23WX-5Q5W-334W

Affected Products

Rengine

References · 8

• 🔥 https://github.com/yogeshojha/rengine/security/advisories/GHSA-23wx-5q5w-334w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24967.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-24967 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24967 · Vendor Advisory
• https://twitter.com/CVEnew/status/1886861322442227786 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1887022523151188457 · Twitter Post
• https://t.me/cvedetector/17228 · Telegram Post
• https://t.me/cvenotify/122027 · Telegram Post