Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: mykiot Clear all filters
TI-2025-11626 CVE-2025-12674 · GHSA-f8wq-xr9h-w4f8

KiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Upload

Priority MEDIUM 50

The KiotViet Sync plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the create_media() function in all versions up to, and including, 1.8.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00838 Published 2025-11-05 No fix listed CWE-434
TI-2025-11629 CVE-2025-12677 · GHSA-48mf-wgq9-gwrv

KiotViet Sync <= 1.8.5 - Unauthenticated Webhook Key Exposure

Priority LOW 30

The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the register_api_route() function in kiotvietsync/includes/public_actions/WebHookActi…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00273 Published 2025-11-05 No fix listed CWE-200