255 matches found
EUVD-2026-62289
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments...
CVE-2026-19416
KiviCare WordPress plugin before 4.5.4 suffers an IDOR flaw: appointment cancellation/rescheduling endpoints lack ownership checks, letting authenticated patient-level users cancel or reschedule other patients' appointments. Upgrade to 4.5.4 to resolve. No in-the-wild exploitation details are pro...
CVE-2026-19417
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports...
EUVD-2026-62290
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports...
KiviCare Clinic & Patient Management System (EHR) <= 3.6.4 - SQL Injection
The KiviCare Clinic & Patient Management System EHR plugin for WordPress is vulnerable to SQL Injection via the 'visittypeserviceid' parameter of the taxcalculateddata AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of...
KiviCare WordPress Plugin - Cross-Site Scripting
The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape the 'filterType' parameter, leading to Reflected Cross-Site Scripting. id: CVE-2023-2624 info: name: KiviCare WordPress Plugin - Cross-Site Scripting author: ritikchaddha severity: medium description: | The KiviCare WordPress...
WordPress KiviCare <2.3.9 - SQL Injection
WordPress KiviCare plugin before 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape some parameters before using them in SQL statements via the ajaxpost AJAX action with the getdoctordetails route. An attacker can possibly obtain sensitive information, modify...
WordPress KiviCare plugin < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint vulnerability
Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint vulnerability discovered by Mokksh Parekh in WordPress Plugin KiviCare versions 4.5.2...
CVE-2026-15453
The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...
CVE-2026-15453
The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...
EUVD-2026-58860
The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...
CVE-2026-15453
CVE-2026-15453 affects the KiviCare – Clinic & Patient Management System (EHR) WordPress plugin. The issue is a generic SQL Injection in the internal searchTerm parameter across all versions up to 4.5.1, caused by insufficient escaping and lack of proper query preparation. This allows authenticat...
CVE-2026-15453 KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter
The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...
Exploit for CVE-2026-13610
CVE-2026-13610 — KiviCare – Clinic & Patient Management System...
PT-2026-72151
The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...
WordPress KiviCare plugin < 4.5.2 - Unauthenticated Privilege Escalation via Registration vulnerability
Unauthenticated Privilege Escalation via Registration vulnerability discovered by Sai Praneeth Koti in WordPress Plugin KiviCare versions 4.5.2...
CVE-2026-73188
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-13610...