Vulnerability & Exploit Database

This is the list of vulnerabilities you can detect with Pentest-Tools.com and the exploits currently available in the platform.

We detect more than 17.593 vulnerabilities with multiple tools (Network Scanner, Website Scanner, Wordpress Scanner, and more) and we also have 222 exploit modules in Sniper to validate the risk level of critical CVEs.

Display

Displaying 1 - 25 results out of 17.593

Pentest-Tools.com Vulnerabilities
Name	Detectable with	Detection added	CVSSv3	EPSS Score	EPSS Percentile	Exploitable with Sniper
BeyondTrust Remote Support <= 26.2.3 - Origin Validation File Upload CVE-2026-102764	Network Scanner	Nov 3, 2026	Critical(9.3)	0.19	0.98	No
Typemill CMS < 2.23.0 - Cross-Site Scripting CVE-2026-53468	Network Scanner	Nov 3, 2026	Medium(4.6)	0.01	0.15	No
bWAPP Default Login	Network Scanner	Nov 3, 2026	Critical	N/A	N/A	No
MLflow 3.10.0-3.16.1 - Arbitrary File Read CVE-2026-116690	Network Scanner	Nov 3, 2026	High(7.5)	0.01	0.47	No
Langflow 1.7.2-1.10.0 - Authenticated Remote Code Execution CVE-2026-7873	Network Scanner	Nov 3, 2026	Critical(9.9)	0.02	0.76	No
Elementor 4.3.0 - 4.3.1 - REST Nonce Bypass	Network Scanner	Nov 3, 2026	Medium	N/A	N/A	No
GitLab CE/EE < 19.2.8 / 19.3.5 / 19.4.2 - Unauthenticated RCE via Onigmo Integer Overflow CVE-2026-97229	Network Scanner	Nov 3, 2026	Critical(10)	0.28	0.99	No
PHP 8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12 - Use-After-Free Remote Code Execution CVE-2026-109619	Network Scanner	Nov 3, 2026	Critical(9.2)	1	1	No
Product Filter by WBW <= 3.4.6 - SQL Injection CVE-2026-112866	Network Scanner	Nov 3, 2026	Critical(9.3)	0.01	0.3	No
WordPress LearnPress < 4.4.1 - Cross-Site Scripting CVE-2026-12970	Network Scanner	Nov 3, 2026	High(7.1)	0.01	0.17	No
Plex Media Server < 1.43.3.10861 - Unauthenticated SSRF via Companion Protocol (plex2shell) CVE-2026-96652	Network Scanner	Nov 2, 2026	Medium(4.3)	0.02	0.79	No
Langchain-Chatchat <= 0.3.1.3 - Unauthenticated RCE CVE-2026-75128	Network Scanner	Nov 2, 2026	Critical(9.8)	0.01	0.51	No
ClickHouse Server - Brotli v1.2.0 Decoder DoS/OOB-Write CVE-2026-116366	Network Scanner	Nov 2, 2026	Critical(9.5)	0.01	0.34	No
NUUO Crystal Server - Unauthenticated File Upload Remote Code Execution	Network Scanner	Oct 30, 2026	Critical	N/A	N/A	No
Transmission 4.0.0-4.1.2 - Permissive CORS Exposes RPC Session ID CVE-2026-116748	Network Scanner	Oct 30, 2026	Medium(8.8)	0.02	0.7	No
Zammad 6.3.0-6.5.4 - Session Hijacking & Remote Code Execution CVE-2026-102489	Network Scanner	Oct 29, 2026	Critical(9.8)	0.23	0.98	No
FUXA <= 1.1.12 - Unauthenticated SQL Injection CVE-2023-31719	Network Scanner	Oct 29, 2026	Critical(9.8)	0.45	0.99	No
GeoNetwork - Server-Side Request Forgery (SSRF) CVE-2026-55864	Network Scanner	Oct 29, 2026	High(8.6)	0.02	0.74	No
LearnPress <= 4.4.9.1 - PHP Object Injection CVE-2026-104736	Network Scanner	Oct 29, 2026	Critical(9.8)	0.03	0.85	No
WordPress Check & Log Email < 2.0.15 - SQL Injection CVE-2026-14554	Network Scanner	Oct 29, 2026	Medium(6.5)	0.02	0.73	No
XWiki Platform - Password Hash Disclosure CVE-2026-48048	Network Scanner	Oct 29, 2026	High(7.5)	0.03	0.81	No
XWiki Platform - Path Traversal CVE-2026-34151	Network Scanner	Oct 29, 2026	High(8.2)	0.03	0.85	No
DVWA Exposed Setup Page	Network Scanner	Oct 29, 2026	High	N/A	N/A	No
Diafan CMS 6.0 - Cross-Site Scripting	Network Scanner	Oct 29, 2026	Medium	N/A	N/A	No
eXtplorer <= 2.1.14 - Authentication Bypass CVE-2023-54335	Network Scanner	Oct 29, 2026	Critical(9.8)	0.14	0.97	No

Vulnerability & Exploit Database

One of EMEA's fastest-growing tech companies

Independently audited company-wide ISMS

50,000+ security folks are here. Are you?

Security leaders trust what they can prove