Iqonic Kivicare
10 CVEs affecting Iqonic Kivicare. Latest disclosed: 2025-02-28. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0786 | Critical | 9.8 | 2022-06-13 | The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with… |
CVE-2023-2628 | High | 8.8 | 2023-06-27 | The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers… |
CVE-2024-11728 | High | 7.5 | 2024-12-06 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the t… |
CVE-2025-1572 | Medium | 6.5 | 2025-02-28 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_id’ parameter in all versions up to, and… |
CVE-2024-11730 | Medium | 6.5 | 2024-12-06 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'sort[]' parameter of the static_data_list… |
CVE-2024-11729 | Medium | 6.5 | 2024-12-06 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'service_list[0][service_id]' parameter of… |
CVE-2023-2623 | Medium | 6.5 | 2023-06-27 | The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users suc… |
CVE-2023-2624 | Medium | 6.1 | 2023-06-27 | The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2024-35659 | Medium | 5.3 | 2024-06-08 | Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2023-2627 | Medium | 4.3 | 2023-06-27 | The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such a… |