Advisories · Technology

mykiot KiotViet Sync.

Every CVE that names mykiot KiotViet Sync among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-12675 CVE record

CVSS 4.3 Medium

KiotViet Sync <= 1.8.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update
- mykiot KiotViet Sync
- Broken access control
Not analysed yet 5 Nov 2025
CVE-2025-12676 CVE record

CVSS 5.3 Medium

KiotViet Sync <= 1.8.5 - Use of Hard-coded Password to Authorization Bypass
- mykiot KiotViet Sync
- Hard-coded credentials
Not analysed yet 5 Nov 2025
CVE-2025-12674 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

KiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Upload
- mykiot KiotViet Sync
- Unrestricted file upload
Not analysed yet 5 Nov 2025
CVE-2025-12677 CVE record

CVSS 5.3 Medium

KiotViet Sync <= 1.8.5 - Unauthenticated Webhook Key Exposure
- mykiot KiotViet Sync
- Information disclosure
Not analysed yet 5 Nov 2025