CVE-2023-2623: falha em KiviCare
KiviCare Management System < 3.2.1 - Subscriber+ Sensitive Information Disclosure
Publicada em · Atualizada em
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.8%
probabilidade de exploração
0.8%top 46% das CVEs
exploração observada
nãonenhuma fonte reporta
The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to retrieve sensitive information such as the user email and hashed password of other users
Produtos afetados
Unknown · KiviCareCVEs relacionadas — KiviCare
No mesmo produto, das mais perigosas para as menos.
CVE-2023-2624—KiviCare Management System < 3.2.1 - Reflected Cross-Site ScriptingEPSS 1.2%CVE-2026-13613HIGHKiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST EndpointEPSS 0.4%CVE-2026-13610HIGHKiviCare < 4.5.2 - Unauthenticated Privilege Escalation via RegistrationEPSS 0.4%CVE-2023-2628—KiviCare Management System < 3.2.1 - Multiple CSRFEPSS 0.4%CVE-2026-19417MEDIUMKiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOREPSS 0.3%CVE-2026-19416MEDIUMKiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOREPSS 0.3%