CVE-2022-28995

Rengine v1.0.2 was discovered to contain a remote code execution RCE vulnerability via the yaml configuration function...

CVE-2022-28995

Rengine v1.0.2 was discovered to contain a remote code execution RCE vulnerability via the yaml configuration function...

CVE-2022-28995

Rengine v1.0.2 was discovered to contain a remote code execution RCE vulnerability via the yaml configuration function...

CVE-2022-28995

CVE-2022-28995 affects Rengine v1.0.2. The vulnerability enables remote code execution via the YAML configuration function. The issue is confirmed across multiple sources (NVD, Red Hat, OSV, etc.). Practical impact is remote code execution with network access and no authentication required, as de...

Rengine 安全漏洞

Rengine is an automated reconnaissance framework for gathering information during penetration testing of web applications. A security vulnerability exists in Rengine version 1.0.2, which stems from the discovery of a Remote Code Execution RCE vulnerability via the yaml configuration function...

CVE-2022-28995: Undefined Security Weakness

Rengine v1.0.2 was discovered to contain a remote code execution RCE vulnerability via the yaml configuration function...

PT-2022-19351 · Rengine · Rengine

Name of the Vulnerable Software and Affected Versions: Rengine version 1.0.2 Description: The issue is related to a remote code execution RCE vulnerability via the yaml configuration function. Recommendations: For Rengine version 1.0.2, consider disabling the yaml configuration function as a...

Stored XSS Via Markdown payload at HackerOne Settings

Description Rengine supports automatic vulnerability reporting to hackerone the module included a feature to customize the report using a markdown editor. Although it was blocking some malicious payloads, the Cross-Site Scripting was found exploitable via a special payload. Proof of Concept 1. Go...

Blind command injection

Description Hello , its my first report in huntr.dev fast code review : file https://github.com/yogeshojha/rengine/blob/master/web/api/views.pyL820 class CMSDetectorAPIView: def getself, request: req = self.request url = req.queryparams.get'url' savedb = True if 'savedb' in req.queryparams else...

CVE-2021-39491

A Cross Site Scripting XSS vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion confirmation modal box...

CVE-2021-39491

A Cross Site Scripting XSS vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion confirmation modal box...

CVE-2021-39491

A Cross Site Scripting XSS vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion confirmation modal box...

Cross site scripting

A Cross Site Scripting XSS vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion confirmation modal box...

CVE-2021-39491

CVE-2021-39491 affects Yogesh Ojha reNgine v1.0. The vulnerability is a Cross Site Scripting (XSS) issue exploitable via the Scan Engine name file in the Scan Engine deletion confirmation modal box, caused by the handling of the deletion confirmation UI. The connected documents corroborate the XS...

CVE-2021-39491

A Cross Site Scripting XSS vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion confirmation modal box...

CVE-2021-39491

A Cross Site Scripting XSS vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion confirmation modal box...

CVE-2021-39491: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion confirmation modal box...

Yogesh Ojha reNgine 跨站脚本漏洞

Yogesh Ojha reNgine is an automated reconnaissance framework for web applications by the individual developer Yogesh Ojha. Focused on a highly configurable streamlined scouting process supported by an engine, scouting data correlation and organization, continuous monitoring, supported by a databa...

PT-2022-10922

Name of the Vulnerable Software and Affected Versions reNgine version 1.0 Description A Cross Site Scripting XSS issue exists via the Scan Engine name file in the Scan Engine deletion confirmation modal box. Recommendations For version 1.0, consider disabling the Scan Engine deletion confirmation...

Command Injection in yogeshojha/rengine

✍️ Description RCE via the proxy feature of Rengine. Proxies can be added in Rengine for executables like httpx to use in a scan. This functionality can be used to inject a command and run arbitrary code. 🕵️‍♂️ Proof of Concept Add this as the only proxy in the proxy list in the Proxy settings:...