Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:kivicare:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Kivicare (2164e48f-bc87-5d93-990a-8f5f36a1439a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-13610 |
vulnerable | 2026-09-16 04:32:50.312794 |
KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration
The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data.
Published: 2026-08-13T06:00:12.789Z
Updated: 2026-08-14T19:00:23.813Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13612 |
vulnerable | 2026-09-16 04:32:50.151446 |
KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR
The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.
Published: 2026-08-12T06:00:12.393Z
Updated: 2026-08-13T15:51:42.869Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13613 |
vulnerable | 2026-09-16 04:32:49.908690 |
KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.
Published: 2026-08-12T06:00:12.602Z
Updated: 2026-08-12T19:35:22.549Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2628 |
vulnerable | 2026-06-08 06:02:42.670620 |
KiviCare Management System < 3.2.1 - Multiple CSRF
The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary appointments/medical records/etc, create/update various users (patients, doctors etc)
Published: 2023-06-27T13:17:22.624Z
Updated: 2024-11-27T19:14:47.509Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2627 |
vulnerable | 2026-06-08 06:02:42.670299 |
KiviCare Management System < 3.2.1 - Subscriber+ Unauthorised AJAX Calls
The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings
Published: 2023-06-27T13:17:06.660Z
Updated: 2024-12-03T17:10:09.353Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2624 |
vulnerable | 2026-06-08 06:02:42.652757 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2623 |
vulnerable | 2026-06-08 06:02:42.651180 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.