CVE-2025-39381

Summary

CVE-2025-39381 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the KiotViet Sync application, version n/a through 1.8.4. An attacker exploiting this issue can inject malicious code into a user's web session, resulting in Stored Cross-Site Scripting (XSS) attacks. The CSRF vulnerability enables the attacker to perform unintended actions on behalf of the victim, while the Stored XSS adds an extra layer of risk by injecting permanent malicious scripts into web pages viewed by the victim, potentially leading to data theft or other malicious activities. Users are advised to upgrade to the latest version of KiotViet Sync to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.