Vulnerability & Exploit Database

This is the list of vulnerabilities you can detect with Pentest-Tools.com and the exploits currently available in the platform.

We detect more than 17.620 vulnerabilities with multiple tools (Network Scanner, Website Scanner, Wordpress Scanner, and more) and we also have 223 exploit modules in Sniper to validate the risk level of critical CVEs.

Display

Displaying 1 - 25 results out of 17.620

Pentest-Tools.com Vulnerabilities
Name	Detectable with	Detection added	CVSSv3	EPSS Score	EPSS Percentile	Exploitable with Sniper
SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header CVE-2026-12592	Network Scanner	Nov 9, 2026	High(7.5)	0.01	0.63	No
LatePoint < 5.7.7 - Unauthenticated Authentication Bypass / Account Takeover CVE-2026-118066	Network Scanner	Nov 9, 2026	Critical(9.8)	0.01	0.59	No
Event Booking Manager for WooCommerce <= 5.3.6 - PHP Object Injection CVE-2026-16062	Network Scanner	Nov 9, 2026	Medium(6.6)	0.01	0.49	No
Barracuda Email Security Gateway - Authentication Bypass CVE-2026-116606	Network Scanner	Nov 9, 2026	Critical(9.3)	0.02	0.76	No
Welcart e-Commerce < 2.11.32 - SQL Injection CVE-2026-16065	Network Scanner	Nov 9, 2026	Medium(6.5)	0.01	0.35	No
WordPress Drag and Drop File Upload for Elementor Forms <=1.5.3 - Unauthenticated Arbitrary File Upload CVE-2025-49387	Network Scanner	Nov 9, 2026	Critical(10)	0.01	0.33	No
Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field CVE-2026-12583	Network Scanner	Nov 6, 2026	High(8.1)	0.03	0.82	No
EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure CVE-2026-118523	Network Scanner	Nov 6, 2026	Medium(5.3)	0.01	0.41	No
Zulip Server 11.0 - 12.1 - Unauthenticated Custom Profile Field Disclosure CVE-2026-115574	Network Scanner	Nov 6, 2026	Medium(5.3)	0.01	0.54	No
WordPress Welcart e-Commerce < 2.12.7 - Cross-Site Scripting CVE-2026-120597	Network Scanner	Nov 6, 2026	Medium(4.3)	0.01	0.49	No
WordPress Better Search < 4.5.3 - Unauthenticated Arbitrary Post Type Content Disclosure CVE-2026-119495	Network Scanner	Nov 6, 2026	Medium(5.3)	0.01	0.49	No
ComfyUI-Manager < 3.39.2 - CRLF Configuration Injection CVE-2026-22777	Network Scanner	Nov 6, 2026	High(7.5)	0.01	0.59	No
VikRentCar <= 1.4.10 - Cross-Site Scripting CVE-2026-116548	Network Scanner	Nov 6, 2026	High(7.2)	0.01	0.45	No
ape-volo-admin <= 3.5.2 - Authentication Bypass via Hardcoded JWT Signing Key CVE-2026-120442	Network Scanner	Nov 6, 2026	Critical(9.8)	0.02	0.78	No
OpenSSH musl - Authentication Bypass (CVE-2026-123158 - *sshole) CVE-2026-123158	Network Scanner	Nov 5, 2026	High(8.1)	0.02	0.64	Yes
Jpom 2.10.0-2.11.12 - Authentication Bypass CVE-2026-120201	Network Scanner	Nov 5, 2026	Critical(9.8)	0.03	0.83	No
OpenPanel - Unauthenticated Bull Board Queue Dashboard CVE-2026-116817	Network Scanner	Nov 4, 2026	Medium(6.5)	0.01	0.48	No
JBoss AS/EAP Admin Console - Default Login	Network Scanner	Nov 4, 2026	Critical	N/A	N/A	No
Langflow 1.8.3 and 1.9.0 - Authenticated MCP Stdio Command Execution CVE-2026-105740	Network Scanner	Nov 4, 2026	Critical(9.9)	0.04	0.91	No
Laravel TokenGuard - Authentication Bypass CVE-2026-114509	Network Scanner	Nov 4, 2026	Critical(9.2)	0.02	0.8	No
PIAF-HMS ec.php - SQL Injection CVE-2026-54419	Network Scanner	Nov 4, 2026	Critical(9.8)	0.02	0.75	No
Plex Media Server < 1.43.3.10861 - SSRF via Transcoder CVE-2026-96655	Network Scanner	Nov 4, 2026	Medium(5.3)	0.11	0.96	No
madong-admin-saas <= 5.1.4 - Unauthenticated Platform Tenant Management Access CVE-2026-120446	Network Scanner	Nov 4, 2026	High(8.8)	0.02	0.65	No
SUSE Rancher - Stored XSS via Unauthenticated Settings Override CVE-2026-88804	Network Scanner	Nov 4, 2026	Critical(9.6)	0.02	0.65	No
Drupal Commerce Core < 3.3.13 / < 8.x-2.41 - Guest Cart Admin Access Bypass CVE-2026-118539	Network Scanner	Nov 4, 2026	Critical(6.5)	0.01	0.53	No

Vulnerability & Exploit Database

One of EMEA's fastest-growing tech companies

Independently audited company-wide ISMS

50,000+ security folks are here. Are you?

Security leaders trust what they can prove