CVE-2025-61319

{
  "id": "CVE-2025-61319",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-10T14:15:43.500",
  "lastModified": "2026-11-05T22:10:00.203",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module. When scanning a target with an XSS payload, the unsanitized payload is rendered in the ReNgine web UI, resulting in arbitrary JavaScript execution in the victim's browser. This can be abused to steal session cookies, perform unauthorized actions, or compromise the ReNgine administrator's account."
    },
    {
      "lang": "es",
      "value": "ReNgine hasta 2.2.0 es vulnerable a una vulnerabilidad de cross-site scripting (XSS) almacenado en el módulo de Vulnerabilidades. Al escanear un objetivo con una carga útil de XSS, la carga útil no saneada se renderiza en la interfaz de usuario web de ReNgine, lo que resulta en la ejecución arbitraria de JavaScript en el navegador de la víctima. Esto puede ser abusado para robar cookies de sesión, realizar acciones no autorizadas o comprometer la cuenta del administrador de ReNgine."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-10T14:23:16.586185Z",
          "id": "CVE-2025-61319",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:yogeshojha:rengine:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "2.2.0",
              "matchCriteriaId": "0709ECF2-2717-4831-8F35-DEC99FD46C0E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/AmalJafarzade/CVE-2025-61319/",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/yogeshojha/rengine",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}