Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-61319 — Stored XSS in ReNgine <= 2.2.0 — public disclosure | Kitploit
Tools/GitHubGitHub/amaljafarzade/cve-2025-61319
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPapers & Research
GitHubamaljafarzade/cve-2025-61319

CVE-2025-61319

Stored XSS in ReNgine <= 2.2.0 — public disclosure

View Repository
10 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-61319: Stored XSS in ReNgine <= 2.2.0

Discovered by: Amal J Vendor: ReNgine
CVE ID: CVE-2025-61319
Status: RESERVED (Public reference added: pending MITRE update)

Description

A Stored Cross-Site Scripting (XSS) vulnerability exists in ReNgine <= 2.2.0 within the Vulnerabilities module.
When a target is scanned with a malicious payload, the payload is rendered unsanitized in the ReNgine web UI, resulting in arbitrary JavaScript execution in the administrator’s browser.

Impact

  • Session hijacking
  • UI compromise
  • Unauthorized actions on admin session

Proof of Concept (PoC)

  1. Scan a URL with payload: ?param="><svg onload=confirm('xss')>
  2. After scan completion, open the Vulnerabilities tab in ReNgine and view results.
  3. The payload executes in the admin's browser context.

Affected versions

  • ReNgine <= 2.2.0

Remediation

Sanitize and escape user-supplied input before rendering scan results.
Implement proper HTML encoding for user-controlled output in the Vulnerabilities tab.

References

  • Official ReNgine Repository
Download Tool