Unknown KiviCare

• CVE-2026-13611 Medium 5.3 KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure 0.3%
• CVE-2026-19417 Medium 6.5 KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR 0.3%
• CVE-2026-19416 Medium 4.3 KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR 0.3%
• CVE-2026-13610 High 7.5 KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration 0.4%
• CVE-2026-13613 High 8.8 KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint 0.4%
• CVE-2026-13612 Medium 4.3 KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR 0.3%
• CVE-2023-2624 Unrated KiviCare Management System < 3.2.1 - Reflected Cross-Site Scripting 1.2%
• CVE-2023-2628 Unrated KiviCare Management System < 3.2.1 - Multiple CSRF 0.4%
• CVE-2023-2623 Unrated KiviCare Management System < 3.2.1 - Subscriber+ Sensitive Information Disclosure 0.8%
• CVE-2023-2627 Unrated KiviCare Management System < 3.2.1 - Subscriber+ Unauthorised AJAX Calls 0.2%