Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: qriouslad Component: System Dashboard Clear all filters
TI-2024-11409 CVE-2024-12299 · GHSA-v4f5-fhv2-ffvh

System Dashboard <= 2.8.17 - Reflected Cross-Site Scripting via Filename Parameter

Priority LOW 27

The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, and including, 2.8.17 due to insufficient input sanitization and output escaping…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00411 Published 2025-01-30 No fix listed CWE-79
TI-2024-10291 CVE-2024-11107 · GHSA-9m9r-rw59-qh84

System Dashboard < 2.8.15 - Unauthenticated Stored XSS

Priority MEDIUM 60

The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00342 Published 2024-12-10 Fixed in 2.8.15 CWE-79
TI-2024-09923 CVE-2024-10708 · GHSA-j3vp-3p2j-8q53

System Dashboard < 2.8.15 - Admin+ Path Traversal

Priority MEDIUM 56

The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the serve…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.02041 Published 2024-12-10 Fixed in 2.8.15 CWE-22
TI-2023-06630 CVE-2023-7246 · GHSA-qmw9-5q6h-hjxj

System Dashboard < 2.8.10 - XSS via Header Injection

Priority MEDIUM 58

The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00807 Published 2024-03-20 Fixed in 2.8.10 CWE-79
TI-2023-05253 CVE-2023-5710 · GHSA-c82g-962c-cx6h

System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_constants)

Priority LOW 20

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants() function hooked via an AJAX action in all versions up to, and including, 2.8.…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00468 Published 2023-12-07 No fix listed CWE-862
TI-2023-05256 CVE-2023-5713 · GHSA-mgjw-x57p-2wmf

System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_option_value)

Priority LOW 20

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_value() function hooked via an AJAX action in all versions up to, and including, 2…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00469 Published 2023-12-07 No fix listed CWE-862
TI-2023-05255 CVE-2023-5712 · GHSA-rxgg-v778-g4xj

System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_global_value)

Priority LOW 20

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_value() function hooked via an AJAX action in all versions up to, and including, 2…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00432 Published 2023-12-07 No fix listed CWE-862
TI-2023-05257 CVE-2023-5714 · GHSA-7hj5-pcgr-frg2

System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_db_specs)

Priority LOW 20

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs() function hooked via an AJAX action in all versions up to, and including, 2.8.7…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00441 Published 2023-12-07 No fix listed CWE-862
TI-2023-05254 CVE-2023-5711 · GHSA-jrgx-m53m-vr33

System Dashboard <= 2.8.8 - Missing Authorization to Information Disclosure (sd_php_info)

Priority LOW 20

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info() function hooked via an AJAX action in all versions up to, and including, 2.8.7…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00442 Published 2023-12-07 No fix listed CWE-862