Vulnerability & Exploit Database

This is the list of vulnerabilities you can detect with Pentest-Tools.com and the exploits currently available in the platform.

We detect more than 17.566 vulnerabilities with multiple tools (Network Scanner, Website Scanner, Wordpress Scanner, and more) and we also have 210 exploit modules in Sniper to validate the risk level of critical CVEs.

Display

Displaying 1 - 25 results out of 17.566

Pentest-Tools.com Vulnerabilities
Name	Detectable with	Detection added	CVSSv3	EPSS Score	EPSS Percentile	Exploitable with Sniper
LearnPress <= 4.4.9.1 - PHP Object Injection CVE-2026-104736	Network Scanner	Oct 29, 2026	Critical(9.8)	0.01	0.53	No
XWiki Platform - Password Hash Disclosure CVE-2026-48048	Network Scanner	Oct 29, 2026	High(7.5)	0.01	0.52	No
eXtplorer <= 2.1.14 - Authentication Bypass CVE-2023-54335	Network Scanner	Oct 29, 2026	Critical(9.8)	0.06	0.93	No
FUXA <= 1.1.12 - Unauthenticated SQL Injection CVE-2023-31719	Network Scanner	Oct 29, 2026	Critical(9.8)	0.27	0.98	No
XWiki Platform - Path Traversal CVE-2026-34151	Network Scanner	Oct 29, 2026	High(8.2)	0.02	0.65	No
GeoNetwork - Server-Side Request Forgery (SSRF) CVE-2026-55864	Network Scanner	Oct 29, 2026	High(8.6)	0.01	0.48	No
DVWA Exposed Setup Page	Network Scanner	Oct 29, 2026	High	N/A	N/A	No
Diafan CMS 6.0 - Cross-Site Scripting	Network Scanner	Oct 29, 2026	Medium	N/A	N/A	No
Zammad 6.3.0-6.5.4 - Session Hijacking & Remote Code Execution CVE-2026-102489	Network Scanner	Oct 29, 2026	Critical(9.8)	0.02	0.81	No
WordPress Check & Log Email < 2.0.15 - SQL Injection CVE-2026-14554	Network Scanner	Oct 29, 2026	Medium(6.5)	0.01	0.35	No
Docker-Proxy hubcmdui - Missing Authentication on /api/config CVE-2026-116070	Network Scanner	Oct 28, 2026	Medium(6.5)	0.01	0.18	No
SiYuan 2.9.0-3.8.6 - Unauthenticated XSS via check-auth "to" Parameter CVE-2026-116167	Network Scanner	Oct 28, 2026	High(7.6)	0.01	0.17	No
Traefik < 2.11.55 / 3.0.0 - 3.7.10 - Digest Authentication Bypass CVE-2026-85595	Network Scanner	Oct 28, 2026	Critical(9.8)	0.03	0.85	No
OpenEMR < 8.0.0 - MedEx Callback Unauthenticated Token Disclosure CVE-2026-24898	Network Scanner	Oct 28, 2026	Critical(10)	0.01	0.48	No
MLflow <3.17.0 - Unauthenticated SSRF via Third-Party (TruLens) Scorer CVE-2026-115886	Network Scanner	Oct 28, 2026	Medium(6.5)	0.01	0.26	No
Collabora Built-in CODE Server < 26.4.303 - OS Command Injection CVE-2026-110447	Network Scanner	Oct 28, 2026	Critical(9.2)	0.12	0.97	No
WP Booking System <= 2.1.0.3 - Unauthenticated Email Log Disclosure CVE-2026-108123	Network Scanner	Oct 28, 2026	High(7.5)	0.01	0.25	No
YesWiki < 4.7.0 - Unauthenticated Server-Side Request Forgery CVE-2026-116205	Network Scanner	Oct 27, 2026	Medium(5.3)	0.01	0.44	No
W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write CVE-2026-18051	Network Scanner	Oct 27, 2026	Critical(10)	0.03	0.81	No
Huang Yaoshi Pharmaceutical Management Software - Unrestricted File Upload CVE-2024-56829	Network Scanner	Oct 27, 2026	Critical(10)	0.03	0.82	No
Ruoyi-Vue-Pro - Unauthenticated Admin Takeover via Predictable SMS Code CVE-2026-116006	Network Scanner	Oct 27, 2026	Critical(9.2)	0.01	0.58	No
danmu_api - Unauthenticated Access to Admin API via Default Token CVE-2026-116485	Network Scanner	Oct 27, 2026	Critical(9.8)	0.03	0.84	No
NEX-Forms Express WP Form Builder < 9.2.3 - Unauthenticated Stored XSS CVE-2026-10525	Network Scanner	Oct 27, 2026	High(8.8)	0.01	0.44	No
Lighter - Config Exposed	Network Scanner	Oct 27, 2026	Medium	N/A	N/A	No
AhsayCBS <= 10.3.4 - Unauthenticated RCE CVE-2026-105134	Network Scanner	Oct 27, 2026	Critical(10)	0.82	1	No

Vulnerability & Exploit Database

One of EMEA's fastest-growing tech companies

Independently audited company-wide ISMS

50,000+ security folks are here. Are you?

Security leaders trust what they can prove