Extension WordPress
Vulnérabilités System Dashboard
Cette page rassemble les failles publiées pour System Dashboard, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de System Dashboard
11 fiches
System Dashboard <= 2.8.20 – Cross-Site Request Forgery
The System Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.20. This is due to missing nonce validation on the sd_toggle_logs() function. This makes it possible for unauthenticated attackers…
*-2.8.20
2.8.21
25/09/2025
System Dashboard <= 2.8.18 – Authenticated (Subscriber+) Sensitive Information Exposure
The System Dashboard plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration…
*-2.8.18
2.8.19
23/02/2025
System Dashboard <= 2.8.17 – Reflected Cross-Site Scripting via Filename Parameter
The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, and including, 2.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
*-2.8.17
2.8.18
30/01/2025
System Dashboard <= 2.8.14 – Authenticated (Admin+) Arbitrary File Read
The System Dashboard plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.14 via the 'sd_viewer' action. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the…
*-2.8.14
2.8.15
19/11/2024
System Dashboard <= 2.8.14 – Unauthenticated Stored Cross-Site Scripting
The System Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.8.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…
*-2.8.14
2.8.15
19/11/2024
System Dashboard <= 2.8.9 – Reflected Cross-Site Scripting via X-Forwarded-For
The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'X-Forwarded-For' header in all versions up to, and including, 2.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
*-2.8.9
2.8.10
28/02/2024
System Dashboard <= 2.8.8 – Missing Authorization to Information Disclosure (sd_php_info)
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes…
*-2.8.7
2.8.8
06/12/2023
System Dashboard <= 2.8.7 – Missing Authorization to Information Disclosure (sd_option_value)
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes…
*-2.8.7
2.8.8
06/12/2023
System Dashboard <= 2.8.7 – Missing Authorization to Information Disclosure (sd_constants)
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes…
*-2.8.7
2.8.8
06/12/2023
System Dashboard <= 2.8.7 – Missing Authorization to Information Disclosure (sd_global_value)
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes…
*-2.8.7
2.8.8
06/12/2023
System Dashboard <= 2.8.7 – Missing Authorization to Information Disclosure (sd_db_specs)
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes…
*-2.8.7
2.8.8
06/12/2023
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.