The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.5.0. This vulnerability allows authenticated attackers with Doctor-level access to append SQL queries and extract sensitive database information. The vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity.
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress has an authorization bypass vulnerability in all versions up to, and including, 4.4.0. This allows unauthenticated attackers to mark arbitrary pending appointments as Confirmed and forge an associated completed payment record. The vulnerability is due to improper verification of user authorization for actions. The exploit is achi [truncated]
