Plugin icon

KiviCare – Clinic & Patient Management System (EHR)

kivicare-clinic-management-system

Vulnerabilities:

28

Last Updated:

August 22, 2026

Active Installs:

2000

Published
Title
Fixed in
CVSS
Published
2026-08-17
Title
KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR
Fixed in
Fixed in 4.5.4
CVSS
6.5 (medium)
Published
2026-08-17
Title
KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR
Fixed in
Fixed in 4.5.4
CVSS
4.3 (medium)
Published
2026-08-14
Title
KiviCare < 4.5.2 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter
Fixed in
Fixed in 4.5.2
CVSS
6.5 (medium)
Published
2026-08-11
Title
KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration
Fixed in
Fixed in 4.5.2
CVSS
9.1 (critical)
Published
2026-08-10
Title
KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR
Fixed in
Fixed in 4.5.2
CVSS
4.3 (medium)
Published
2026-08-10
Title
KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint
Fixed in
Fixed in 4.5.2
CVSS
4.9 (medium)
Published
2026-07-10
Title
KiviCare < 4.5.1 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder
Fixed in
Fixed in 4.5.1
CVSS
6.5 (medium)
Published
2026-07-10
Title
KiviCare < 4.5.1 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController
Fixed in
Fixed in 4.5.1
CVSS
6.5 (medium)
Published
2026-07-09
Title
KiviCare < 4.5.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint
Fixed in
Fixed in 4.5.0
CVSS
5.3 (medium)
Published
2026-05-26
Title
KiviCare – Clinic & Patient Management System (EHR) < 4.4.0 - Missing Authorization
Fixed in
Fixed in 4.4.0
CVSS
5.3 (medium)
Published
2026-04-23
Title
KiviCare – Clinic & Patient Management System (EHR) < 4.3.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Fixed in
Fixed in 4.3.0
CVSS
4.3 (medium)
Published
2026-03-23
Title
KiviCare – Clinic & Patient Management System (EHR) < 4.0.0 - Missing Authorization
Fixed in
Fixed in 4.0.0
CVSS
5.3 (medium)
Published
2026-03-23
Title
KiviCare – Clinic & Patient Management System (EHR) < 4.0.0 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.0.0
CVSS
6.1 (medium)
Published
2026-03-17
Title
KiviCare < 4.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard
Fixed in
Fixed in 4.1.3
CVSS
8.2 (high)
Published
2026-03-17
Title
KiviCare – Clinic & Patient Management System (EHR) < 4.1.3 - Unauthenticated Authentication Bypass via Social Login Token
Fixed in
Fixed in 4.1.3
CVSS
7.3 (high)
Published
2026-02-01
Title
KiviCare < 4.0.0 - Authenticated (Receptionist+) SQL Injection
Fixed in
Fixed in 4.0.0
CVSS
6.5 (medium)
Published
2026-01-22
Title
KiviCare – Clinic & Patient Management System (EHR) < 3.6.16 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload
Fixed in
Fixed in 3.6.16
CVSS
5.3 (medium)
Published
2025-11-27
Title
KiviCare < 3.6.14 - Authenticated (Patient+) SQL Injection
Fixed in
Fixed in 3.6.14
CVSS
6.5 (medium)
Published
2025-02-27
Title
KiviCare – Clinic & Patient Management System (EHR) < 3.6.8 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter
Fixed in
Fixed in 3.6.8
CVSS
6.5 (medium)
Published
2024-12-05
Title
KiviCare – Clinic & Patient Management System (EHR) < 3.6.5 - Authenticated (Doctor/Receptionist+) SQL Injection
Fixed in
Fixed in 3.6.5
CVSS
6.5 (medium)
Published
2024-12-05
Title
KiviCare – Clinic & Patient Management System (EHR) < 3.6.5 - Unauthenticated SQL Injection
Fixed in
Fixed in 3.6.5
CVSS
7.5 (high)
Published
2024-12-05
Title
KiviCare – Clinic & Patient Management System (EHR) < 3.6.5 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 3.6.5
CVSS
6.5 (medium)
Published
2024-06-03
Title
KiviCare < 3.6.7 - Patient+ Insecure Direct Object Reference
Fixed in
Fixed in 3.6.7
CVSS
4.3 (medium)
Published
2023-06-05
Title
KiviCare Management System < 3.2.1 - Subscriber+ Sensitive Information Disclosure
Fixed in
Fixed in 3.2.1
CVSS
6.5 (medium)
Published
2023-06-05
Title
KiviCare Management System < 3.2.1 - Subscriber+ Unauthorised AJAX Calls
Fixed in
Fixed in 3.2.1
CVSS
8.8 (high)
Published
2023-06-05
Title
KiviCare Management System < 3.2.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.2.1
CVSS
7.1 (high)
Published
2023-06-05
Title
KiviCare Management System < 3.2.1 - Multiple CSRF
Fixed in
Fixed in 3.2.1
CVSS
8.1 (high)
Published
2022-05-23
Title
KiviCare < 2.3.9 - Unauthenticated SQLi
Fixed in
Fixed in 2.3.9
CVSS
8.6 (high)