underconstruction project underconstruction vulnerabilities and exploits

(subscribe to this query)

Cross-site request forgery (CSRF) vulnerability in the underConstruction plugin prior to 1.09 for WordPress allows remote malicious users to hijack the authentication of administrators for requests that deactivate a plugin via unspecified vectors.

Underconstruction Project Underconstruction 1.02 Underconstruction Project Underconstruction 1.04 Underconstruction Project Underconstruction 1.06 Underconstruction Project Underconstruction Underconstruction Project Underconstruction 1.03 Underconstruction Project Underconstruction 1.0 Underconstruction Project Underconstruction 1.07 Underconstruction Project Underconstruction 1.05 Underconstruction Project Underconstruction 1.01

The underConstruction WordPress plugin prior to 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow malicious users to make a logged in admin perform such action via a CSRF attack

Underconstruction Project Underconstruction

The underConstruction WordPress plugin prior to 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiletred_html capability ...

Underconstruction Project Underconstruction

The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by ...

Underconstruction Project Underconstruction

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook