mykiot

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

mykiot records in CISA KEV

No mykiot vulnerabilities are listed in CISA KEV.

Records

4 records

TI-2025-11626 CVE-2025-12674 · GHSA-f8wq-xr9h-w4f8

KiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Upload

MEDIUM 50

The KiotViet Sync plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the create_media() function in all versions up to, and including, 1.8.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00838 Published 2025-11-05 No fix listed CWE-434

TI-2025-11629 CVE-2025-12677 · GHSA-48mf-wgq9-gwrv

KiotViet Sync <= 1.8.5 - Unauthenticated Webhook Key Exposure

LOW 30

The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the register_api_route() function in kiotvietsync/includes/public_actions/WebHookActi…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00273 Published 2025-11-05 No fix listed CWE-200

TI-2025-11628 CVE-2025-12676 · GHSA-6rw4-g9p6-qw7p

KiotViet Sync <= 1.8.5 - Use of Hard-coded Password to Authorization Bypass

LOW 30

The KiotViet Sync plugin for WordPress is vulnerable to authorizarion bypass in all versions up to, and including, 1.8.5.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00312 Published 2025-11-05 No fix listed CWE-259

TI-2025-11627 CVE-2025-12675 · GHSA-h8f7-hc62-fwj7

KiotViet Sync <= 1.8.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update

LOW 19

The KiotViet Sync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveConfig() function in all versions up to, and including, 1.8.5.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00201 Published 2025-11-05 No fix listed CWE-862

Open these records in search →

Critical	1
High	0
Medium	3
Low	0
No CVSS	0