Vulnerabilities and security researches forsystem-dashboard system-dashboard

Jun 07, 2024

CVE, Research URL: CVE-2023-7246
Home page URL: Security reports for System Dashboard
Application: System Dashboard
Date: Mar 20, 2024
Research Description: The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2023-5712
Home page URL: Security reports for System Dashboard
Application: System Dashboard
Date: Dec 07, 2023
Research Description: The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive global value information.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2023-5713
Home page URL: Security reports for System Dashboard
Application: System Dashboard
Date: Dec 07, 2023
Research Description: The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve potentially sensitive option values, and deserialize the content of those values.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2023-5710
Home page URL: Security reports for System Dashboard
Application: System Dashboard
Date: Dec 07, 2023
Research Description: The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information such as database credentials.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2023-5714
Home page URL: Security reports for System Dashboard
Application: System Dashboard
Date: Dec 07, 2023
Research Description: The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve data key specs.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2023-5711
Home page URL: Security reports for System Dashboard
Application: System Dashboard
Date: Dec 07, 2023
Research Description: The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information provided by PHP info.
Affected versions: Min -, max -.
Status: vulnerable

Nov 23, 2024

CVE, Research URL: CVE-2024-10708
Home page URL: Security reports for System Dashboard
Application: System Dashboard
Date: Dec 10, 2024
Research Description: The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2024-11107
Home page URL: Security reports for System Dashboard
Application: System Dashboard
Date: Dec 10, 2024
Research Description: The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
Affected versions: Min -, max -.
Status: vulnerable

Feb 27, 2025

CVE, Research URL: CVE-2025-26911
Home page URL: Security reports for System Dashboard
Application: System Dashboard
Date: Feb 25, 2025
Research Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bowo System Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects System Dashboard: from n/a through 2.8.18.
Affected versions: Min -, max -.
Status: vulnerable

May 06, 2025

CVE, Research URL: CVE-2024-12299
Home page URL: Security reports for System Dashboard
Application: System Dashboard
Date: Jan 30, 2025
Research Description: The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, and including, 2.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
Affected versions: Min -, max -.
Status: vulnerable