What’s Vulnerable › Products

iqonicdesign KiviCare – Clinic & Patient Management System (EHR) vulnerabilities

29 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 23 published in the last 12 months.

Check whether your iqonicdesign KiviCare – Clinic & Patient Management System (EHR) version is affected

Latest iqonicdesign KiviCare – Clinic & Patient Management System (EHR) vulnerabilities

• CVE-2026-13611 — KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure (CVSS 5.3)
• CVE-2026-19417 — KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR (CVSS 6.5)
• CVE-2026-19416 — KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR (CVSS 4.3)
• CVE-2026-15453 — KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter (CVSS 6.5)
• CVE-2026-13610 — KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration (CVSS 7.5)
• CVE-2026-13613 — KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint (CVSS 8.8)
• CVE-2026-13612 — KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR (CVSS 4.3)
• CVE-2026-15073 — KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController (CVSS 6.5)
• CVE-2026-15072 — KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder (CVSS 6.5)
• CVE-2026-11990 — KiviCare <= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint (CVSS 5.3)
• CVE-2026-40792 — WordPress KiviCare plugin <= 4.2.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.3)
• CVE-2026-42735 — WordPress KiviCare plugin <= 4.3.0 - Broken Authentication vulnerability (CVSS 8.2)
• CVE-2026-25383 — WordPress KiviCare plugin <= 3.6.16 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-25034 — WordPress KiviCare plugin <= 3.6.16 - Broken Access Control vulnerability (CVSS 6.5)
• CVE-2026-2992 — KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard (CVSS 8.2)
• CVE-2026-2991 — KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token (CVSS 7.3)
• CVE-2026-25022 — WordPress KiviCare plugin <= 3.6.16 - SQL Injection vulnerability (CVSS 8.5)
• CVE-2026-0927 — KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload (CVSS 5.3)
• CVE-2025-66095 — WordPress KiviCare plugin <= 3.6.13 - SQL Injection vulnerability (CVSS 8.5)
• CVE-2025-1572 — KiviCare – Clinic & Patient Management System (EHR) <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter (CVSS 8.8)
• CVE-2024-11730 — KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection (CVSS 6.5)
• CVE-2024-11729 — KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5)
• CVE-2024-11728 — KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection (CVSS 7.5)
• CVE-2024-35659 — WordPress KiviCare plugin <= 3.6.6 - Insecure Direct Object References (IDOR) vulnerability (CVSS 8.8)
• CVE-2023-2628 — KiviCare Management System < 3.2.1 - Multiple CSRF (CVSS 8.8)