Yogeshojha vulnerabilities
We track 4 vulnerabilities in Yogeshojha products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on February 4, 2025.
Latest Yogeshojha vulnerabilities
- 8.8 High severity
rengine: Improper Access Control
reNgine is an automated reconnaissance framework for web applications. An unrestricted project deletion vulnerability allows attackers with specific roles, such as `penetration_tester` or `auditor` to delete all projects in the system. This can lead to a compl
- 8.8 High severity
rengine: Improper Neutralization of Special Elements in Output Used by a Downstream Component
reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmap_cmd parameters. This issue has been addressed in commit `c28e5c8d` and is expected in the next versioned release. Users are advi
- 7.5 High severity
rengine: Exposure of Sensitive Information to an Unauthorized Actor
reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where **an insider attacker with any role** (such as Auditor, Penetration Tester, or Sys Admin) **can extract sensitive information from other reN
- 8.8 High severity
Rengine: Improper Neutralization of Special Elements used in an OS Command
reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.