Veille CVE

Recherche « Unknown KiviCare »

6 CVE

Critique 0 Élevée 2 Moyenne 4 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown KiviCare » ✕
  1. CVE-2026-13611 5.3 Moyenne

    Unknown KiviCare

    The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key.

  2. CVE-2026-19417 6.5 Moyenne

    Unknown KiviCare

    The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports.

  3. CVE-2026-19416 4.3 Moyenne

    Unknown KiviCare

    The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments.

  4. CVE-2026-13610 7.5 Élevée

    Unknown KiviCare

    The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data.

  5. CVE-2026-13613 8.8 Élevée

    Unknown KiviCare

    The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.

  6. CVE-2026-13612 4.3 Moyenne

    Unknown KiviCare

    The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.