Vulnerability & Exploit Database

This is the list of vulnerabilities you can detect with Pentest-Tools.com and the exploits currently available in the platform.

We detect more than 17.569 vulnerabilities with multiple tools (Network Scanner, Website Scanner, Wordpress Scanner, and more) and we also have 211 exploit modules in Sniper to validate the risk level of critical CVEs.

Display

Displaying 1 - 25 results out of 17.569

Pentest-Tools.com Vulnerabilities
Name	Detectable with	Detection added	CVSSv3	EPSS Score	EPSS Percentile	Exploitable with Sniper
Transmission 4.0.0-4.1.2 - Permissive CORS Exposes RPC Session ID CVE-2026-116748	Network Scanner	Oct 30, 2026	Medium(8.8)	0.02	0.7	No
NUUO Crystal Server - Unauthenticated File Upload Remote Code Execution	Network Scanner	Oct 30, 2026	Critical	N/A	N/A	No
FUXA <= 1.1.12 - Unauthenticated SQL Injection CVE-2023-31719	Network Scanner	Oct 29, 2026	Critical(9.8)	0.45	0.99	No
WordPress Check & Log Email < 2.0.15 - SQL Injection CVE-2026-14554	Network Scanner	Oct 29, 2026	Medium(6.5)	0.02	0.73	No
XWiki Platform - Path Traversal CVE-2026-34151	Network Scanner	Oct 29, 2026	High(8.2)	0.03	0.85	No
GeoNetwork - Server-Side Request Forgery (SSRF) CVE-2026-55864	Network Scanner	Oct 29, 2026	High(8.6)	0.02	0.74	No
Diafan CMS 6.0 - Cross-Site Scripting	Network Scanner	Oct 29, 2026	Medium	N/A	N/A	No
eXtplorer <= 2.1.14 - Authentication Bypass CVE-2023-54335	Network Scanner	Oct 29, 2026	Critical(9.8)	0.14	0.97	No
DVWA Exposed Setup Page	Network Scanner	Oct 29, 2026	High	N/A	N/A	No
Zammad 6.3.0-6.5.4 - Session Hijacking & Remote Code Execution CVE-2026-102489	Network Scanner	Oct 29, 2026	Critical(9.8)	0.23	0.98	No
XWiki Platform - Password Hash Disclosure CVE-2026-48048	Network Scanner	Oct 29, 2026	High(7.5)	0.03	0.81	No
LearnPress <= 4.4.9.1 - PHP Object Injection CVE-2026-104736	Network Scanner	Oct 29, 2026	Critical(9.8)	0.03	0.85	No
Docker-Proxy hubcmdui - Missing Authentication on /api/config CVE-2026-116070	Network Scanner	Oct 28, 2026	Medium(6.5)	0.01	0.46	No
SiYuan 2.9.0-3.8.6 - Unauthenticated XSS via check-auth "to" Parameter CVE-2026-116167	Network Scanner	Oct 28, 2026	High(7.6)	0.01	0.52	No
Traefik < 2.11.55 / 3.0.0 - 3.7.10 - Digest Authentication Bypass CVE-2026-85595	Network Scanner	Oct 28, 2026	Critical(9.8)	0.03	0.85	No
WP Booking System <= 2.1.0.3 - Unauthenticated Email Log Disclosure CVE-2026-108123	Network Scanner	Oct 28, 2026	High(7.5)	0.02	0.64	No
OpenEMR < 8.0.0 - MedEx Callback Unauthenticated Token Disclosure CVE-2026-24898	Network Scanner	Oct 28, 2026	Critical(10)	0.03	0.85	No
MLflow <3.17.0 - Unauthenticated SSRF via Third-Party (TruLens) Scorer CVE-2026-115886	Network Scanner	Oct 28, 2026	Medium(6.5)	0.01	0.53	No
Collabora Built-in CODE Server < 26.4.303 - OS Command Injection CVE-2026-110447	Network Scanner	Oct 28, 2026	Critical(9.2)	0.74	1	No
danmu_api - Unauthenticated Access to Admin API via Default Token CVE-2026-116485	Network Scanner	Oct 27, 2026	Critical(9.8)	0.03	0.84	No
YesWiki < 4.7.0 - Unauthenticated Server-Side Request Forgery CVE-2026-116205	Network Scanner	Oct 27, 2026	Medium(5.3)	0.01	0.44	No
W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write CVE-2026-18051	Network Scanner	Oct 27, 2026	Critical(10)	0.03	0.81	No
Huang Yaoshi Pharmaceutical Management Software - Unrestricted File Upload CVE-2024-56829	Network Scanner	Oct 27, 2026	Critical(10)	0.03	0.82	No
Ruoyi-Vue-Pro - Unauthenticated Admin Takeover via Predictable SMS Code CVE-2026-116006	Network Scanner	Oct 27, 2026	Critical(9.2)	0.01	0.58	No
NEX-Forms Express WP Form Builder < 9.2.3 - Unauthenticated Stored XSS CVE-2026-10525	Network Scanner	Oct 27, 2026	High(8.8)	0.01	0.44	No

Vulnerability & Exploit Database

One of EMEA's fastest-growing tech companies

Independently audited company-wide ISMS

50,000+ security folks are here. Are you?

Security leaders trust what they can prove