Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

kodezen — Vulnerabilities & Security Advisories 16

Browse all 16 CVE security advisories affecting kodezen. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Kodezen develops web application frameworks primarily used for building enterprise solutions, with its products enabling rapid development of business applications. Historically, the framework has been susceptible to multiple remote code execution vulnerabilities, cross-site scripting flaws, and privilege escalation issues, accounting for its seven recorded CVEs. Security researchers have identified consistent input validation weaknesses and insecure default configurations in its components. While no major public security incidents have been documented, the accumulation of CVEs suggests ongoing challenges in secure coding practices, particularly regarding sanitization of user-supplied data and access control mechanisms.

CVE ID Title CVSS Severity Published
CVE-2026-118800 aBlocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block Attribute — aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder CWE-79 6.4 Medium 2026-11-07
CVE-2026-118801 aBlocks <= 2.18.0 - Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcode — aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder CWE-200 4.3 Medium 2026-11-07
CVE-2026-120544 Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route — Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning CWE-22 4.3 Medium 2026-11-03
CVE-2026-110018 aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute — aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder CWE-269 8.8 High 2026-10-24
CVE-2026-104022 Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint — Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning CWE-269 5.4 Medium 2026-10-10
CVE-2026-104915 Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id — Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning CWE-862 6.5 Medium 2026-10-10
CVE-2026-15056 StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL — StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More CWE-22 6.5 Medium 2026-08-16
CVE-2026-9341 Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter — Academy LMS CWE-639 4.3 Medium 2026-07-14
CVE-2026-5348 Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure — Academy LMS – WordPress LMS Plugin for Complete eLearning Solution CWE-639 5.3 Medium 2026-07-02
CVE-2025-15521 Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover — Academy LMS – WordPress LMS Plugin for Complete eLearning Solution CWE-639 9.8 Critical 2026-01-21
CVE-2025-12449 aBlocks – WordPress Gutenberg Blocks <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification — aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder CWE-862 5.4 Medium 2026-01-07
CVE-2025-12099 Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses' — Academy LMS – WordPress LMS Plugin for Complete eLearning Solution CWE-502 7.2 High 2025-11-08
CVE-2025-9216 StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload — StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More CWE-434 8.8 High 2025-09-17
CVE-2025-9215 StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Download — StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More CWE-22 6.5 Medium 2025-09-17
CVE-2024-13465 aBlocks – WordPress Gutenberg Blocks <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting — aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder CWE-79 6.4 Medium 2025-02-18
CVE-2024-1505 Academy LMS – eLearning and online course solution for WordPress <= 1.9.19 - Authenticated (Subscriber+) Privilege Escalation — Academy LMS – WordPress LMS Plugin for Complete eLearning Solution CWE-269 8.8 High 2024-03-13

This page lists every published CVE security advisory associated with kodezen. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.