CVE-2025-24899

CVE-2025-24899 is a sensitive information disclosure vulnerability in reNgine, an automated web application reconnaissance framework, affecting versions prior to 2.2.0. An authenticated insider attacker with any role can exploit this flaw by making a GET request to /api/listVulnerability/ to extract sensitive user details like usernames, passwords, and email addresses. This vulnerability has a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity and high confidentiality impact. There is currently no known active exploitation, public exploit code, or significant community discussion surrounding this CVE.