Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: KiviCare 4.5.4 Clear all filters
TI-2026-15833 CVE-2026-19417 · GHSA-34m6-mf7c-4crh

KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR

Priority LOW 29

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, includ…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0034 Published 2026-08-19 Fixed in 4.5.4 CWE-639
TI-2026-15832 CVE-2026-19416 · GHSA-q77f-2653-fm5r

KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR

Priority LOW 20

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00265 Published 2026-08-19 Fixed in 4.5.4 CWE-639