iqonicdesign KiviCare – Clinic & Patient Management System (EHR)

• CVE-2026-15453 Medium 6.5 KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter 0.4%
• CVE-2026-15072 Medium 6.5 KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder 0.5%
• CVE-2026-15073 Medium 6.5 KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController 0.4%
• CVE-2026-11990 Medium 5.3 KiviCare <= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint 0.6%
• CVE-2026-2992 High 8.2 KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard 0.3%
• CVE-2026-2991 High 7.3 KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token 0.5%
• CVE-2026-0927 Medium 5.3 KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload 0.3%
• CVE-2025-1572 Medium 6.5 KiviCare – Clinic & Patient Management System (EHR) <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter 0.5%
• CVE-2024-11729 Medium 6.5 KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection 0.6%
• CVE-2024-11730 Medium 6.5 KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection 0.4%
• CVE-2024-11728 High 7.5 KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection 13.6%