Vulnerability history

Unauthenticated Patient Data Disclosure vulnerability

Patient+ Arbitrary Media Attachment Read via IDOR vulnerability

Patient+ Cross-Patient Appointment Modification via IDOR vulnerability

Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint vulnerability

Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter vulnerability

Unauthenticated Privilege Escalation via Registration vulnerability

Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR vulnerability

SQL Injection vulnerability

SQL Injection vulnerability

Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation vulnerability

Broken Authentication vulnerability

Insecure Direct Object References (IDOR) vulnerability

Reflected Cross Site Scripting (XSS) vulnerability

Broken Access Control vulnerability

WordPress KiviCare - Clinic & Patient Management System (EHR) plugin <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token vulnerability

Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard vulnerability

SQL Injection vulnerability

WordPress KiviCare - Clinic & Patient Management System (EHR) plugin <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload vulnerability

SQL Injection vulnerability

Authenticated (Doctor+) SQL Injection via 'u_id' Parameter vulnerability

Authenticated (Doctor/Receptionist+) SQL Injection vulnerability

Authenticated (Subscriber+) SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability

Insecure Direct Object References (IDOR) vulnerability

Reflected Cross-Site Scripting vulnerability

Subscriber+ Sensitive Information Disclosure vulnerability

Subscriber+ Unauthorised AJAX Calls vulnerability

Multiple CSRF vulnerability

Unauthenticated SQL Injection (SQLi) vulnerability