CVE-2025-24962: Command Injection in reNgine
reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmapcmd parameters. This issue has been addressed in commit c28e5c8d and is expected in the next versioned release. Users are advised to filter user input and monitor the project for a new release.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24962?
CVE-2025-24962 is considered a moderate severity vulnerability due to the potential for command injection via user input.
How do I fix CVE-2025-24962?
To fix CVE-2025-24962, users should update to the next versioned release of reNgine, which includes the necessary security patches.
What is the impact of CVE-2025-24962?
The impact of CVE-2025-24962 allows attackers to execute arbitrary commands through the nmap_cmd parameter if proper validation is not implemented.
Which versions of reNgine are affected by CVE-2025-24962?
CVE-2025-24962 affects all versions of reNgine prior to the next versioned release that addresses this vulnerability.
Who should be concerned about CVE-2025-24962?
Developers and users of reNgine should be concerned about CVE-2025-24962, especially those who handle untrusted user input.