Bowo system dashboard vulnerabilities

Latest Bowo system dashboard CVEs

Newest publication first

1. CVE-2025-26911 WordPress System Dashboard plugin <= 2.8.18 - Sensitive Data Exposure vulnerability

   Published 2025-02-25

   Medium·CVSS 4.3 EPSS 0.38%

   Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bowo System Dashboard system-dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects System Dashboard: from n/a through <= 2.8.18.

2. CVE-2024-12299 System Dashboard <= 2.8.17 - Reflected Cross-Site Scripting via Filename Parameter

   Published 2025-01-30

   Medium·CVSS 6.1 EPSS 0.41%

   The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, and including, 2.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to in...

3. CVE-2024-11107 System Dashboard < 2.8.15 - Unauthenticated Stored XSS

   Published 2024-12-10

   Medium·CVSS 6.1 EPSS 0.34%

   The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.

4. CVE-2024-10708 System Dashboard < 2.8.15 - Admin+ Path Traversal

   Published 2024-12-10

   Medium·CVSS 4.9 EPSS 2.0%

   The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server

5. CVE-2023-7246 System Dashboard < 2.8.10 - XSS via Header Injection

   Published 2024-03-20

   Medium·CVSS 5.4 EPSS 0.81%

   The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks

6. CVE-2023-5713 System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_option_value)

   Published 2023-12-07

   Medium·CVSS 4.3 EPSS 0.47%

   The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, wi...

7. CVE-2023-5710 System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_constants)

   Published 2023-12-07

   Medium·CVSS 4.3 EPSS 0.47%

   The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with...

8. CVE-2023-5714 System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_db_specs)

   Published 2023-12-07

   Medium·CVSS 4.3 EPSS 0.44%

   The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with s...

9. CVE-2023-5712 System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_global_value)

   Published 2023-12-07

   Medium·CVSS 4.3 EPSS 0.43%

   The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, wi...

10. CVE-2023-5711 System Dashboard <= 2.8.8 - Missing Authorization to Information Disclosure (sd_php_info)

    Published 2023-12-07

    Medium·CVSS 4.3 EPSS 0.44%

    The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with s...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.