Advisories · Technology
KiviCare.
Every CVE that names KiviCare among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure
- KiviCare
- Information disclosure
- Broken access control
- CVSS 6.5 Medium
KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR
- KiviCare
- Broken access control
- CVSS 4.3 Medium
KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR
- KiviCare
- Broken access control
- CVSS 7.5 High
KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration
- KiviCare
- Privilege escalation
- CVSS 8.8 High
KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint
- KiviCare
- SQL injection
- CVSS 4.3 Medium
KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR
- KiviCare
- Broken access control
-
KiviCare Management System < 3.2.1 - Reflected Cross-Site Scripting
- KiviCare
-
KiviCare Management System < 3.2.1 - Multiple CSRF
- KiviCare
-
KiviCare Management System < 3.2.1 - Subscriber+ Sensitive Information Disclosure
- KiviCare
-
KiviCare Management System < 3.2.1 - Subscriber+ Unauthorised AJAX Calls
- KiviCare