I noticed that, when I was scanning a site upon request, I found that they came up with 50 XSS vulns.....and rengine has a few too, but I don't think it triggered on nearly all of its own payloads when viewing the vulnerabilities tab