Login Request a demo
KI
Product
Kivicare
by Iqonic · last CVE Feb 28, 2025
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 1High 4Medium 5Low 0
Severity
All severities10Critical1High4Medium5Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Kivicare to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-0786
9.8
13%
Jun 13
The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the…
Affected: before 2.3.9
CVE-2025-1572
8.8
1%
Feb 28
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter
Affected: before 3.6.8
CVE-2024-35659
8.8
0%
Jun 8
WordPress KiviCare plugin <= 3.6.6 - Insecure Direct Object References (IDOR) vulnerability
Affected: through 3.6.4
CVE-2023-2628
8.8
0%
Jun 27
The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers to make logged in…
Affected: before 3.2.1
CVE-2024-11728
7.5
14%
Dec 6
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection
Affected: through 3.6.5
CVE-2024-11729
6.5
1%
Dec 6
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection
Affected: through 3.6.5
CVE-2024-11730
6.5
0%
Dec 6
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection
Affected: before 3.6.5
CVE-2023-2623
6.5
1%
Jun 27
The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to…
Affected: before 3.2.1
CVE-2023-2624
6.1
1%
Jun 27
The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could…
Affected: before 3.2.1
CVE-2023-2627
4.3
0%
Jun 27
The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call…
Affected: before 3.2.1
Showing 10