KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint

KiviCare Management System < 3.2.1 - Multiple CSRF

KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration

KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR

KiviCare Management System < 3.2.1 - Subscriber+ Sensitive Information Disclosure

KiviCare Management System < 3.2.1 - Reflected Cross-Site Scripting

KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure

KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR

KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR

KiviCare Management System < 3.2.1 - Subscriber+ Unauthorised AJAX Calls