Skip to contentIqonic Design Kivicare vulnerabilities
- iqonic design kivicareKiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data DisclosureCVE-2026-136115.3 Medium
- iqonic design kivicareKiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDORCVE-2026-194176.5 Medium
- iqonic design kivicareKiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDORCVE-2026-194164.3 Medium
- iqonic design kivicareKiviCare < 4.5.2 - Unauthenticated Privilege Escalation via RegistrationCVE-2026-13610Public exploit7.5 High
- iqonic design kivicareKiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST EndpointCVE-2026-136138.8 High
- iqonic design kivicareKiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDORCVE-2026-136124.3 Medium
- iqonic design kivicareWordPress KiviCare plugin <= 4.2.1 - Insecure Direct Object References (IDOR) vulnerabilityCVE-2026-407926.3 Medium
- iqonic design kivicareWordPress KiviCare plugin <= 4.3.0 - Broken Authentication vulnerabilityCVE-2026-427358.2 High
- iqonic design kivicareWordPress KiviCare plugin <= 3.6.16 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2026-253837.1 High
- iqonic design kivicareWordPress KiviCare plugin <= 3.6.16 - Broken Access Control vulnerabilityCVE-2026-250346.5 Medium
- iqonic design kivicareWordPress KiviCare plugin <= 3.6.16 - SQL Injection vulnerabilityCVE-2026-250228.5 High
- iqonic design kivicareWordPress KiviCare plugin <= 3.6.13 - SQL Injection vulnerabilityCVE-2025-660958.5 High
- iqonic kivicareWordPress KiviCare plugin <= 3.6.6 - Insecure Direct Object References (IDOR) vulnerabilityCVE-2024-356595.3 Medium
- iqonic kivicareKiviCare Management System < 3.2.1 - Reflected Cross-Site ScriptingCVE-2023-26246.1 Medium
- iqonic kivicareKiviCare Management System < 3.2.1 - Multiple CSRFCVE-2023-26288.8 High
- iqonic kivicareKiviCare Management System < 3.2.1 - Subscriber+ Sensitive Information DisclosureCVE-2023-26236.5 Medium
- iqonic kivicareKiviCare Management System < 3.2.1 - Subscriber+ Unauthorised AJAX CallsCVE-2023-26274.3 Medium