Bowo System Dashboard
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Bowo System Dashboard.
By the Year
In 2026 there have been 0 vulnerabilities in Bowo System Dashboard. Last year, in 2025 System Dashboard had 2 security vulnerabilities published. Right now, System Dashboard is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 2 | 6.10 |
| 2024 | 3 | 0.00 |
| 2023 | 5 | 4.30 |
It may take a day or so for new System Dashboard vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Bowo System Dashboard Security Vulnerabilities
Sensitive Info Exposure in Bowo System Dashboard <2.8.18 via Improper ACL
CVE-2025-26911
- February 25, 2025
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bowo System Dashboard system-dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects System Dashboard: from n/a through <= 2.8.18.
Exposure of Sensitive System Information to an Unauthorized Control Sphere
Reflected XSS in System Dashboard Plugin (<=2.8.15) via Filename
CVE-2024-12299
6.1 - Medium
- January 30, 2025
The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, and including, 2.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
XSS
WordPress System Dashboard Plugin XSS Vulnerability
CVE-2024-11107
- December 10, 2024
The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
XSS
System Dashboard WordPress Plugin: Path Traversal Vulnerability
CVE-2024-10708
- December 10, 2024
The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server
Directory traversal
Unescaped params in System Dashboard WP plugin <2.8.10 allow XSS
CVE-2023-7246
- March 20, 2024
The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks
XSS
WP System Dashboard <=2.8.7 Missing Cap Check Enables Subscriber Data Access
CVE-2023-5714
4.3 - Medium
- December 07, 2023
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve data key specs.
AuthZ
System Dashboard WP Plugin v2.8.7 unauthorized AJAX data access
CVE-2023-5713
4.3 - Medium
- December 07, 2023
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve potentially sensitive option values, and deserialize the content of those values.
AuthZ
Unauthorized Data Access via Missing Capability Check in WordPress SD Plugin 2.8.7
CVE-2023-5712
4.3 - Medium
- December 07, 2023
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive global value information.
AuthZ
Unauthorized Data Access via AJAX in SysDash Plugin 2.8.7 (sd_php_info)
CVE-2023-5711
4.3 - Medium
- December 07, 2023
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information provided by PHP info.
AuthZ
WordPress SD Plugin 2.8.7: Cap Check Missing Enables Unauthorized Data Retrieval
CVE-2023-5710
4.3 - Medium
- December 07, 2023
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information such as database credentials.
AuthZ
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Bowo System Dashboard or by Bowo? Click the Watch button to subscribe.
