9 matches found
CVE-2023-7246
The System Dashboard WordPress plugin before version 2.8.10 is vulnerable to a Cross-Site Scripting (XSS) attack due to insufficient sanitization and escaping of certain parameters. Specifically, the flaw allows for header injection via the X-Forwarded-For header. In a multisite WordPress configu...
CVE-2023-5714
CVE-2023-5714 : The WordPress plugin System Dashboard is vulnerable up to version 2.8.7 due to a missing capability check in the Ajax-hooked function sd_db_specs(), allowing authenticated users with subscriber-level access and above to retrieve data key specs. Reports from NVD and Wordfence align...
CVE-2024-10708
The System Dashboard WordPress plugin, in versions prior to 2.8.15 , is vulnerable to a path traversal attack due to a failure to validate user input used in a path. This flaw allows high-privilege users, such as administrators, to perform path traversal through the filename parameter in the sd_v...
CVE-2023-5713
CVE-2023-5713 concerns the WordPress System Dashboard plugin (versions ≤ 2.8.7). The vulnerability stems from a missing capability check in the sd_option_value() AJAX handler, allowing authenticated users with subscriber-level access and above to obtain potentially sensitive option values and des...
CVE-2024-11107
The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
CVE-2023-5711
CVE-2023-5711 affects the WordPress System Dashboard plugin, where a missing capability check in the sd_php_info() AJAX endpoint allowed authenticated users with subscriber-level access or higher to access sensitive PHP info. Affected versions: all up to 2.8.7. The issue has been tracked across m...
CVE-2023-5712
CVE-2023-5712 affects WordPress System Dashboard plugin. The vulnerability is an unauthorized data-access flaw caused by a missing capability check on the sd_global_value() function exposed via AJAX. It allows authenticated users with subscriber-level access and above to retrieve sensitive global...
CVE-2023-5710
CVE-2023-5710 affects the WordPress System Dashboard plugin up to version 2.8.7, where a missing capability check in the sd_constants() function exposed data via an AJAX action. This allows authenticated users with subscriber-level access or higher to retrieve sensitive information, including dat...