CVE-2025-24967 Stored XSS on Admin Panel When Deleting a User in reNgine
Attackers can inject malicious scripts via usernames, leading to script execution when admins view user entries in the reNgine admin panel.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-24967?
CVE-2025-24967 is a high-severity cross-site scripting vulnerability in yogeshojha rengine, published on 4 Feb 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
reNgine is an automated reconnaissance framework for web applications. A stored cross-site scripting (XSS) vulnerability exists in the admin panel's user management functionality. An attacker can exploit this issue by injecting malicious payloads into the username field during user creation. This vulnerability allows unauthorized script execution whenever the admin views or interacts with the affected user entry, posing a significant risk to sensitive admin functionalities. This issue affects all versions up to and including 2.20. Users are advised to monitor the project for future releases which address this issue. There are no known workarounds.
Weakness: CWE-79
Which versions are affected by CVE-2025-24967?
It affects 1 product.
Products include Yogeshojha Rengine.
How do I fix CVE-2025-24967?
No fix has been published for CVE-2025-24967 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-24967 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-24967 exists.
Other vulnerabilities in yogeshojha rengine
Sources
Also known as GHSA-23wx-5q5w-334w.