Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: KiviCare 4.5.2 Clear all filters
TI-2026-11532 CVE-2026-13613 · GHSA-6rg5-hf6w-rc4q

KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint

Priority HIGH 73

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injec…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0043 Published 2026-08-12 Fixed in 4.5.2 CWE-89
TI-2026-11531 CVE-2026-13612 · GHSA-f444-wc3x-6c2g

KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR

Priority MEDIUM 53

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment deta…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00254 Published 2026-08-12 Fixed in 4.5.2 CWE-639