KC
Product
KiviCare – Clinic & Patient Management System (EHR)
11
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 4Medium 7Low 0
Watch
Add KiviCare – Clinic & Patient Management System (EHR) to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-15453 | 6.5 | Aug 15 | KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter Affected: through 4.5.1 |
| CVE-2026-15072 | 6.5 | Jul 11 | KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder Affected: through 4.5.0 |
| CVE-2026-15073 | 6.5 | Jul 11 | KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController Affected: through 4.5.0 |
| CVE-2024-11729 | 6.5 | Dec 6 | KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection Affected: through 3.6.4 |
| CVE-2024-11730 | 6.5 | Dec 6 | KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection Affected: through 3.6.4 |
| CVE-2026-11990 | 5.3 | Jul 10 | KiviCare <= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint Affected: through 4.4.0 |
| CVE-2026-0927 | 5.3 | Jan 23 | KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload Affected: through 3.6.15 |
Showing 7