Bowo

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Bowo product.

RSS Feeds for Bowo security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Bowo products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Bowo Sorted by Most Security Vulnerabilities since 2018

Bowo System Dashboard10 vulnerabilities

Bowo Debug Log Manager6 vulnerabilities

Bowo Admin Site Enhancements4 vulnerabilities

Bowo Code Explorer1 vulnerability

Bowo Variable Inspector1 vulnerability

By the Year

In 2026 there have been 1 vulnerability in Bowo with an average score of 5.4 out of ten. Last year, in 2025 Bowo had 6 security vulnerabilities published. Right now, Bowo is on track to have less security vulnerabilities in 2026 than it did last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.03.

Year	Vulnerabilities	Average Score
2026	1	5.40
2025	6	4.37
2024	8	7.07
2023	7	4.76

It may take a day or so for new Bowo vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Bowo Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-32423	Mar 13, 2026	Missing Auth in Bowo ASE (8.4.0) via admin-site-enhancements Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 8.4.0.	Admin Site Enhancements
CVE-2025-64255	Dec 09, 2025	Missing Auth in Bowo ASE <=8.0.8 Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 8.0.8.	Admin Site Enhancements
CVE-2025-26914	Mar 03, 2025	Variable Inspector <=2.6.2 Reflected XSS via Unescaped Input Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bowo Variable Inspector variable-inspector allows Reflected XSS.This issue affects Variable Inspector: from n/a through <= 2.6.2.	Variable Inspector
CVE-2025-26911	Feb 25, 2025	Sensitive Info Exposure in Bowo System Dashboard <2.8.18 via Improper ACL Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bowo System Dashboard system-dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects System Dashboard: from n/a through <= 2.8.18.	System Dashboard
CVE-2025-24648	Feb 04, 2025	Privilege Escalation in wpase.com ASE v7.6.2.1 via Incorrect Priv Assignment Incorrect Privilege Assignment vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Privilege Escalation.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 7.6.2.1.	Admin Site Enhancements
CVE-2024-12299	Jan 30, 2025	Reflected XSS in System Dashboard Plugin (<=2.8.15) via Filename The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, and including, 2.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.	System Dashboard
CVE-2025-24649	Jan 24, 2025	wpase.com ASE Missing Auth before 7.6.2 Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 7.6.2.	Admin Site Enhancements
CVE-2024-11107	Dec 10, 2024	WordPress System Dashboard Plugin XSS Vulnerability The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.	System Dashboard
CVE-2024-10708	Dec 10, 2024	System Dashboard WordPress Plugin: Path Traversal Vulnerability The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server	System Dashboard
CVE-2023-5816	Oct 30, 2024	Arbitrary External File Reading in Code Explorer Plugin v1.4.5 WordPress The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading in all versions up to, and including, 1.4.5. This is due to the fact that the plugin does not restrict accessing files to those outside of the WordPress instance, though the intention of the plugin is to only access WordPress related files. This makes it possible for authenticated attackers, with administrator-level access, to read files outside of the WordPress instance.	Code Explorer
CVE-2024-35669	Jun 09, 2024	Missing Auth Vulnerability in Bowo Debug Log Manager <=2.3.1 Missing Authorization vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.1.	Debug Log Manager
CVE-2024-33915	May 03, 2024	Missing Auth in Bowo Debug Log Manager (<2.3.1) Missing Authorization vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.1.	Debug Log Manager
CVE-2024-32582	Apr 18, 2024	Debug Log Manager v2.3.1 Stored XSS before 2.3.2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bowo Debug Log Manager allows Stored XSS.This issue affects Debug Log Manager: from n/a through 2.3.1.	Debug Log Manager
CVE-2023-7246	Mar 20, 2024	Unescaped params in System Dashboard WP plugin <2.8.10 allow XSS The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks	System Dashboard
CVE-2023-6383	Jan 08, 2024	Debug Log Manager WP Plugin <2.3.0 Directory Listing Vulnerability The Debug Log Manager WordPress plugin before 2.3.0 contains a Directory listing vulnerability was discovered, which allows you to download the debug log without authorization and gain access to sensitive data	Debug Log Manager
CVE-2023-5710	Dec 07, 2023	WordPress SD Plugin 2.8.7: Cap Check Missing Enables Unauthorized Data Retrieval The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information such as database credentials.	System Dashboard
CVE-2023-5711	Dec 07, 2023	Unauthorized Data Access via AJAX in SysDash Plugin 2.8.7 (sd_php_info) The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information provided by PHP info.	System Dashboard
CVE-2023-5712	Dec 07, 2023	Unauthorized Data Access via Missing Capability Check in WordPress SD Plugin 2.8.7 The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive global value information.	System Dashboard
CVE-2023-5713	Dec 07, 2023	System Dashboard WP Plugin v2.8.7 unauthorized AJAX data access The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve potentially sensitive option values, and deserialize the content of those values.	System Dashboard
CVE-2023-5714	Dec 07, 2023	WP System Dashboard <=2.8.7 Missing Cap Check Enables Subscriber Data Access The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve data key specs.	System Dashboard
CVE-2023-6136	Nov 30, 2023	CVE-2023-6136: Sensitive Info Leak in Bowo Debug Log Manager <= 2.3.0 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.0.	Debug Log Manager
CVE-2023-5772	Nov 30, 2023	CSRF: Debug Log Manager <=2.2.1 in WordPress The Debug Log Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the clear_log() function. This makes it possible for unauthenticated attackers to clear the debug log via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	Debug Log Manager