Vulnerability & Exploit Database

This is the list of vulnerabilities you can detect with Pentest-Tools.com and the exploits currently available in the platform.

We detect more than 17.364 vulnerabilities with multiple tools (Network Scanner, Website Scanner, Wordpress Scanner, and more) and we also have 195 exploit modules in Sniper to validate the risk level of critical CVEs.

Display

Displaying 1 - 25 results out of 17.364

Pentest-Tools.com Vulnerabilities
Name	Detectable with	Detection added	CVSSv3	EPSS Score	EPSS Percentile	Exploitable with Sniper
ClipBucket v5 <= 5.5.2 - Unauthenticated Blind SQL Injection CVE-2026-21875	Network Scanner	Sep 7, 2026	Critical(9.8)	0.01	0.33	No
WGDashboard < 4.3.2 - Unauthenticated File Read CVE-2026-44343	Network Scanner	Sep 7, 2026	Critical(9.8)	0.01	0.37	No
WeGIA < 3.6.5 - Unauthenticated Authentication Bypass via extract (CVE-2026-28411) CVE-2026-28411	Network Scanner	Sep 7, 2026	Critical(9.8)	0.01	0.47	No
Nacos 3.x - Unauthenticated Admin Takeover	Network Scanner	Sep 7, 2026	Critical	N/A	N/A	No
Nginx UI <= 2.3.7 - Unauthenticated Installer Exposure CVE-2026-42221	Network Scanner	Sep 7, 2026	High(8.1)	0.01	0.28	No
Krayin CRM < 2.2.1 - Installer Authentication Bypass CVE-2026-41452	Network Scanner	Sep 7, 2026	Critical(9.8)	0.03	0.84	No
ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy CVE-2026-23693	Network Scanner	Sep 7, 2026	Critical(10)	0.01	0.58	No
Shield Security <= 21.0.8 - Unauthenticated Reflected XSS CVE-2026-0561	Network Scanner	Sep 7, 2026	Medium(6.1)	0.01	0.42	No
OpenFlagr <= 1.1.18 - Authentication Bypass CVE-2026-0650	Network Scanner	Sep 7, 2026	Critical(9.3)	0.02	0.69	No
JFrog Artifactory Access Blank Join Key Authentication Bypass CVE-2026-82329	Network Scanner	Sep 2, 2026	Critical(9.8)	0.08	0.95	No
mJobTime <= 15.7.2 - Unauthenticated Blind SQL Injection to RCE CVE-2025-51683	Network Scanner	Sep 2, 2026	Critical(9.8)	0.02	0.78	No
GeoNetwork - Reflected Cross-Site Scripting CVE-2026-57582	Network Scanner	Sep 2, 2026	High(8.2)	N/A	N/A	No
Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation CVE-2026-19092	Network Scanner	Sep 2, 2026	Critical(9.8)	0.02	0.73	No
Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection CVE-2026-9586	Network Scanner	Sep 2, 2026	Critical(9.8)	0.12	0.96	No
Mailcow Dockerized Swagger UI - Cross-Site Scripting CVE-2022-39258	Network Scanner	Aug 31, 2026	Medium(6.1)	0.02	0.73	No
GoAhead Camera - Credential Disclosure CVE-2017-8225	Network Scanner	Aug 31, 2026	Critical(9.8)	0.36	0.99	No
DB-GPT <= 0.8.1 - Arbitrary File Write CVE-2026-73034	Network Scanner	Aug 31, 2026	Critical(9.8)	0.06	0.92	No
Gotenberg < 8.31.0 - Server-Side Request Forgery CVE-2026-42596	Network Scanner	Aug 31, 2026	Critical(9.8)	0.02	0.68	No
Amazon rabbitmq-aws 0.1.0 through 0.2.0 - Arbitrary File Read CVE-2026-9133	Network Scanner	Aug 30, 2026	High(7.7)	0.02	0.62	No
Grafana Loki - Unauthenticated API Access	Network Scanner	Aug 30, 2026	Medium	N/A	N/A	No
WP Content Permission <= 1.2 - Cross-Site Scripting CVE-2026-0743	Network Scanner	Aug 30, 2026	Medium(4.4)	0.01	0.46	No
VictoriaMetrics vmagent - Unauthenticated Targets Exposure	Network Scanner	Aug 30, 2026	Low	N/A	N/A	No
Kirby CMS 5.3.0-5.4.0 - Path Traversal CVE-2026-44177	Network Scanner	Aug 30, 2026	High(8.8)	0.02	0.77	No
Gotenberg < 8.34.0 - Local File Disclosure CVE-2026-55229	Network Scanner	Aug 30, 2026	High(7.5)	0.02	0.73	No
Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler CVE-2026-32475	Network Scanner	Aug 27, 2026	Critical(9)	0.03	0.83	No

Vulnerability & Exploit Database

One of EMEA's fastest-growing tech companies

Independently audited company-wide ISMS

50,000+ security folks are here. Are you?

Security leaders trust what they can prove