Changelog

The Network Scanner gained 155 new detections in August, 70 of them critical, prioritized by CVSS, EPSS, and CISA KEV.

The most notable:

◉ JetBrains TeamCity < 2026.1.3, 2025.11.7, remote code execution (CVE-2026-63077)

◉ Metabase, unauthenticated SQL injection (CVE-2026-72898)

◉ ForgeRock AM/OpenAM, remote code execution (CVE-2021-35464)

◉ Cisco ISE < 3.4P2, unauthenticated arbitrary file upload (CVE-2025-20282)

Why it matters

Coverage that lands within days of disclosure is the difference between finding an exposure yourself and reading about it in an incident report.

How to use

Run a scan to check your targets, then put the high-value ones on scheduled monitoring so new coverage applies automatically as it ships.

Scan your targets

Sniper Auto-Exploiter added a new exploit module this month for CVE-2021-35464, a remote code execution vulnerability in Forgerock OpenAM.

The CVE has been public for years, but it's still showing up in live environments, which makes it a good reminder that "old" and "settled" aren't the same thing. Detection is now live in the Network Scanner as well.

Why it matters

A five-year-old CVE still causing damage is exactly the kind of exposure that slips through when a scan schedule assumes older vulnerabilities are already handled. Sniper turns the finding into exploit-backed evidence instead of a CVSS score on a slide.

How to use

Run Sniper against a confirmed target to generate exploit-backed evidence. As always, if Sniper can exploit it, the Network Scanner can detect it.

Prove it with Sniper

We’ve added an exclusive exploit for CVE-2020-36847 (WordPress Simple File List - Unauthenticated RCE) into Sniper, so you can move from suspicion to proof of rce in a controlled, ethical way.

Why it matters
CVE-2020-36847 is a critical, unauthenticated Remote Code Execution vulnerability in the Simple File List plugin for WordPress. Versions up to and including 4.2.2 let an attacker upload a php payload disguised as an image, then use the plugin’s rename function to change the extension to .php and run it on the server. The result is full arbitrary code execution with no login required, a fast path to site takeover, database access, credential theft, and lateral movement if the host can reach internal services. Updating to 4.2.3 or later fixes the issue.

How to use

Validate in Sniper → capture RCE evidence safely → patch the plugin (4.2.3+) → re-run Sniper to confirm remediation and rule out other exposed sites using the same plugin.

We’ve just added an exclusive exploit for CVE-2025-11953 (React Native Community CLI development server) into Sniper and paired it with Network Scanner detection, so you can spot and confirm this RCE in one workflow.

Why it matters
CVE-2025-11953 is a critical, unauthenticated Remote Code Execution issue in the Metro development server started by the react native community cli. The server exposes an endpoint vulnerable to os command injection, letting an external attacker run arbitrary commands on the host if the dev server is reachable over the network. With a CVSS of 9.8, the impact is full compromise of the dev server environment and whatever credentials, source code, or internal network access it can reach.

How to use

Detect with the Network Scanner → validate in Sniper → re-scan to confirm remediation and catch leftover exposure across other hosts running the Metro dev server.

We’ve just added an exclusive exploit for CVE-2025-61882 (Oracle E-Business Suite BI Publisher RCE) into Sniper and paired it with Network Scanner detection - available exclusively to Pentest-Tools.com customers.

Why it matters
This vulnerability is a critical, unauthenticated, pre-auth Remote Code Execution in Oracle EBS (versions 12.2.3 → 12.2.14). It has a CVSS of ~9.8 and is actively exploited in the wild. It allows remote attackers to run arbitrary code and potentially take over the Concurrent Processing subsystem, often containing high-value ERP, payroll, and financial data. This module gives you fast detection and zero-guesswork validation in one place.

How to use

detect with the Network Scanner → validate in Sniper → re-scan to confirm remediation and rule out residual exposure across multiple assets.

Thanks to our security research team, you can now detect:

• CVE-2024-23897 (CVSSv3 7.5) - Unauthenticated Arbitrary File Read in Jenkins

• CVE-2023-41056 (CVSSv3 8.1) - Remote Code Execution in Redis

• CVE-2023-5631 (CVSSv3 5.4) - Cross-Site Scripting in Roundcube

Speaking about Roundcube, a couple of months ago we published an analysis - and public exploit - for CVE-2021-44026, an SQL injection vulnerability in the open-source mail client.

The Network Scanner now also generates explicit findings for sensitive services that shouldn't be exposed on the internet (e.g. SMB, RDP, MySQL), which are easier to include in your reports.

Sniper can exploit a Remote Code Execution vulnerability found in Ivanti Connect Secure (CVE-2024-21887).

Network Scanner detects if CVE-2022-1471 (CVSSv3 10), a Remote Code Execution in SnakeYAML library - Atlassian Confluence, impacts your targets.

Network Scanner detects if CVE-2023-46805 (CVSSv3 8.2), an authentication Bypass in Ivanti Connect Secure, affects your targets.

Sniper can exploit a Remote Code Execution vulnerability found in Apache ActiveMQ (CVE-2023-46604).

Sniper can exploit a Remote Code Execution vulnerability found in SysAid (CVE-2023-47246).

Sniper can exploit an authenticated RCE vulnerability found in Cisco IOS XE (CVE-2023-20273), based on an Authentication Bypass vulnerability (CVE-2023-20198).

Sniper can exploit another RCE vulnerability found in F5 BIG-IP (CVE-2023-46747).

We created an automatic CVE filtering mechanism for duplicated CVEs. For example, if the Sniper or the Nuclei engines find a CVE, only the Sniper finding will be displayed in the report. We'll show them based on prioritization (Sniper > Nuclei > OpenVAS).

Network Scanner detects if CVE-2023-44487 (DOS in HTTP/2 - Rapid Reset) affects your targets.

Sniper can exploit a File Read vulnerability found in SonicWall (CVE-2023-0126).

Sniper can exploit an Information Disclosure vulnerability found in Citrix (CVE-2023-4966 - Citrix Bleed).

Network Scanner detects if CVE-2023-29357 (Authentication Bypass in Microsoft Sharepoint) affects your targets.

Network Scanner detects if CVE-2023-42115 (RCE in Exim) affects your targets.

Sniper can exploit a RCE vulnerability discovered in Juniper (CVE-2023-36845).