CVE-2021-40375

CVE-2021-40375 - OpenEyes 3.5.1 中的失效的访问控制 描述 在由 Apperta Foundation 开发的 OpenEyes 3.5.1 中发现了一个不当的访问控制漏洞。 低权限用户可以在其浏览器中加载患者档案，并在未具备所需权限级别的情况下访问敏感信息。尽管应用程序在网页上返回了“Forbidden”（禁止访问）消息，但服务器响应仍返回了关于该患者的全部信息。这些信息可以通过拦截代理查看，或者直接在浏览器中查看页面源代码来获取。 复现步骤 1. 以高权限用户身份查看患者档案。 2. 复制该患者档案的 URL。 3. 退出 OpenEyes 会话。 4...

WordPress KiviCare plugin < 4.5.5 - Unauthenticated Patient Data Disclosure vulnerability

Unauthenticated Patient Data Disclosure vulnerability discovered by Sai Praneeth Koti in WordPress Plugin KiviCare versions 4.5.5...

CVE-2026-13611 KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure

The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key...

CVE-2026-13611

The KiviCare WordPress plugin (a Clinic & Patient Management System / EHR) prior to version 4.5.5 is missing authorization checks on certain REST endpoints , enabling unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key...

WordPress KiviCare plugin < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR vulnerability

Patient+ Arbitrary Media Attachment Read via IDOR vulnerability discovered by Erwan LR WPScan in WordPress Plugin KiviCare versions 4.5.4...

CVE-2026-19417

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports...

CVE-2026-19416 KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments...

CVE-2026-19416 KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments...

CVE-2026-19417

The KiviCare WordPress plugin, in versions prior to 4.5.4 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The software fails to verify if a requesting user is entitled to access specific media files being served. This allows authenticated patient-level users to bypass authoriz...

CVE-2026-19417 KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports...

CVE-2026-50576

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The...

WordPress KiviCare plugin < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR vulnerability

Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR vulnerability discovered by Sai Praneeth Koti in WordPress Plugin KiviCare versions 4.5.2...

PT-2026-71390

The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff doctor account with full access to patient records, billing and clinic data...

CVE-2026-13612

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details...

CVE-2026-13612 KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details...

CVE-2026-13612

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details...

CVE-2026-67610 OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...

CVE-2026-67610

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...

PT-2026-67439

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...

EUVD-2026-43127

The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...