What’s Vulnerable › Vulnerabilities

CVE-2022-0786: KiviCare < 2.3.9 - Unauthenticated SQLi

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 13.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-06-13 · updated 2026-06-17
• Weakness: CWE-89

Description

The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users

Affected products

• iqonicdesign KiviCare – Clinic & Patient Management System (EHR): before 2.3.9 — fixed in 2.3.9

How to fix

Upgrade to a fixed version: iqonicdesign KiviCare – Clinic & Patient Management System (EHR) 2.3.9. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/53f493e9-273b-4349-8a59-f2207e8f8f30
• https://wpscan.com/vulnerability/53f493e9-273b-4349-8a59-f2207e8f8f30

Get alerted when CVE-2022-0786 or the next vulnerability affects your stack