Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
189 results · page 2 of 4
Apr 1, 2025Clinic’s Patient Management System versions 2.0 suffers from a SQL injection vulnerability in the login page.CVE-2025-3096 · Other software · SourceCodester · reported by cve@rapid7.comCritical 9.3
Clinic’s Patient Management System versions 2.0 suffers from a SQL injection vulnerability in the login page.
- Product
- Clinic's Patient Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.orgsourcecodester.com
Mar 28, 2025Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System.CVE-2025-2870 · Other software · Clinic Queuing System · reported by cve-coordination@incibe.esMedium 4.8
Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the page parameter in /patient_side.php.
- Product
- Clinic Queuing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System.CVE-2025-2869 · Other software · Clinic Queuing System · reported by cve-coordination@incibe.esMedium 4.8
Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the id parameter in /manage_user.php.
- Product
- Clinic Queuing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System.CVE-2025-2868 · Other software · Clinic Queuing System · reported by cve-coordination@incibe.esMedium 4.8
Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the page parameter in /index.php.
- Product
- Clinic Queuing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2025KiviCare – Clinic & Patient Management System (EHR): SQL InjectionCVE-2025-1572 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_id’ parameter in all versions up to, and including, 3.6.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with doctor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- KiviCare – Clinic & Patient Management System (EHR)
- Affected
- up to 3.6.7
- What to do
- Affects up to 3.6.7. Update KiviCare – Clinic & Patient Management System (EHR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 2025MediCenter - Health Medical Clinic: Missing AuthorizationCVE-2025-27013 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MediCenter - Health Medical Clinic: from n/a through < 14.7.
- Product
- MediCenter - Health Medical Clinic
- What to do
- Update MediCenter - Health Medical Clinic to the newest version.
Dec 6, 2024KiviCare – Clinic & Patient Management System (EHR): SQL InjectionCVE-2024-11730 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'sort[]' parameter of the static_data_list AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with doctor/receptionist-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- KiviCare – Clinic & Patient Management System (EHR)
- Affected
- up to 3.6.4
- What to do
- Affects up to 3.6.4. Update KiviCare – Clinic & Patient Management System (EHR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 6, 2024KiviCare – Clinic & Patient Management System (EHR): SQL InjectionCVE-2024-11729 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'service_list[0][service_id]' parameter of the get_widget_payment_options AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- KiviCare – Clinic & Patient Management System (EHR)
- Affected
- up to 3.6.4
- What to do
- Affects up to 3.6.4. Update KiviCare – Clinic & Patient Management System (EHR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 6, 2024KiviCare – Clinic & Patient Management System (EHR): SQL InjectionCVE-2024-11728 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the tax_calculated_data AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- KiviCare – Clinic & Patient Management System (EHR)
- Affected
- up to 3.6.4
- What to do
- Affects up to 3.6.4. Update KiviCare – Clinic & Patient Management System (EHR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 14, 2024The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form.CVE-2024-48971 · Other software · Baxter · reported by productsecurity@baxter.comCritical 9.3
The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the password off the ventilator and use it to gain unauthorized access to the device, with clinician privileges.
- Product
- Life2000 Ventilation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password.CVE-2024-9832 · Other software · Baxter · reported by productsecurity@baxter.comCritical 9.3
There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make changes to device settings that could disrupt the function of the device and/or result in unauthorized information disclosure.
- Product
- Life2000 Ventilation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024Online Clinic Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /success/editp.php?action=edit.CVE-2024-48597 · Other software · online_clinic_management_system_project · reported by MITREHigh 8.1
Online Clinic Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /success/editp.php?action=edit.
- Product
- online_clinic_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2024Scout is a web-based visualizer for VCF-files.CVE-2024-47531 · Other software · Clinical-Genomics · reported by GitHubMedium 4.6
Scout is a web-based visualizer for VCF-files. Due to the lack of sanitization in the filename, it is possible bypass intended file extension and make users download malicious files with any extension. With malicious content injected inside the file data and users unknowingly downloading it and opening may lead to the compromise of users' devices or data. This vulnerability is fixed in 4.89.
- Product
- scout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2024Scout is a web-based visualizer for VCF-files.CVE-2024-47530 · Other software · Clinical-Genomics · reported by GitHubMedium 5.4
Scout is a web-based visualizer for VCF-files. Open redirect vulnerability allows performing phishing attacks on users by redirecting them to malicious page. /login API endpoint is vulnerable to open redirect attack via next parameter due to absence of sanitization logic. Additionally, due to lack of scheme validation, HTTPS Downgrade Attack can be performed on the users. This vulnerability is fixed in 4.89.
- Product
- scout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2024Online Clinic Management System In PHP With Free Source code v1.0 was discovered to contain a SQL injection vulnerability via the user parameter at login.php.CVE-2024-40393 · Other software · Angeljudesuarez · reported by MITRECritical 9.8
Online Clinic Management System In PHP With Free Source code v1.0 was discovered to contain a SQL injection vulnerability via the user parameter at login.php.
- Product
- Online Clinic Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2024A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1.CVE-2024-4654 · Other software · BlueNet Technology · reported by VulDBMedium 6.3
A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /xds/cloudInterface.php. The manipulation of the argument INSTI_CODE leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263499.
- Product
- Clinical Browsing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2024A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1 and classified as critical.CVE-2024-4653 · Other software · BlueNet Technology · reported by VulDBMedium 6.3
A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1 and classified as critical. Affected by this issue is some unknown functionality of the file /xds/outIndex.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263498 is the identifier assigned to this vulnerability.
- Product
- Clinical Browsing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2024A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1.CVE-2024-4257 · Other software · BlueNet Technology · reported by VulDBMedium 6.3
A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /xds/deleteStudy.php. The manipulation of the argument documentUniqueId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-262149 was assigned to this vulnerability.
- Product
- Clinical Browsing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024MJM Clinic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29096 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Manning MJM Clinic.This issue affects MJM Clinic: from n/a through 1.1.22.
- Product
- MJM Clinic
- Affected
- up to 1.1.22
- What to do
- Affects up to 1.1.22. Update MJM Clinic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 19, 2024MJM Clinic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29140 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Manning MJM Clinic allows Stored XSS.This issue affects MJM Clinic: from n/a through 1.1.22.
- Product
- MJM Clinic
- Affected
- up to 1.1.22
- What to do
- Affects up to 1.1.22. Update MJM Clinic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 19, 2024An issue was discovered in OpenClinic GA 5.247.01.CVE-2023-40279 · Other software · openclinic · reported by MITREHigh 7.5
An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to main.do.
- Product
- ga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Mar 19, 2024An issue was discovered in OpenClinic GA 5.247.01.CVE-2023-40278 · Other software · openclinic · reported by MITREHigh 7.5
An issue was discovered in OpenClinic GA 5.247.01. An Information Disclosure vulnerability has been identified in the printAppointmentPdf.jsp component of OpenClinic GA. By changing the AppointmentUid parameter, an attacker can determine whether a specific appointment exists based on the error message.
- Product
- ga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Mar 18, 2024An issue was discovered in OpenClinic GA 5.247.01.CVE-2023-40280 · Other software · openclinic_ga_project · reported by MITREHigh 7.5
An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to popup.jsp.
- Product
- openclinic_ga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Mar 18, 2024An issue was discovered in OpenClinic GA 5.247.01.CVE-2023-40277 · Other software · openclinic_ga_project · reported by MITREMedium 6.1
An issue was discovered in OpenClinic GA 5.247.01. A Reflected Cross-Site Scripting (XSS) vulnerability has been discovered in the login.jsp message parameter.
- Product
- openclinic_ga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Mar 18, 2024An issue was discovered in OpenClinic GA 5.247.01.CVE-2023-40276 · Other software · openclinic_ga_project · reported by MITRECritical 9.1
An issue was discovered in OpenClinic GA 5.247.01. An Unauthenticated File Download vulnerability has been discovered in pharmacy/exportFile.jsp.
- Product
- openclinic_ga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Mar 18, 2024An issue was discovered in OpenClinic GA 5.247.01.CVE-2023-40275 · Other software · openclinic_ga_project · reported by MITRECritical 9.1
An issue was discovered in OpenClinic GA 5.247.01. It allows retrieval of patient lists via queries such as findFirstname= to _common/search/searchByAjax/patientslistShow.jsp.
- Product
- openclinic_ga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourceforge.net
Jan 26, 2024An issue in Luxe Beauty Clinic mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-48126 · Other software · Linecorp · reported by MITREMedium 5.4
An issue in Luxe Beauty Clinic mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2024An issue in Ailand clinic mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-44001 · Other software · Linecorp · reported by MITREMedium 5.4
An issue in Ailand clinic mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2024An issue in PRIMA CLINIC mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43991 · Other software · Linecorp · reported by MITREMedium 5.4
An issue in PRIMA CLINIC mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persiCVE-2023-6425 · Other software · BigProf · reported by cve-coordination@incibe.esMedium 6.3
A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /clinic/medical_records_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.
- Product
- Online Clinic Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordincibe.esexploit-db.com
Nov 30, 2023A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persiCVE-2023-6424 · Other software · BigProf · reported by cve-coordination@incibe.esMedium 6.3
A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /clinic/disease_symptoms_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.
- Product
- Online Clinic Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persiCVE-2023-6423 · Other software · BigProf · reported by cve-coordination@incibe.esMedium 6.3
A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /clinic/events_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.
- Product
- Online Clinic Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persiCVE-2023-6422 · Other software · BigProf · reported by cve-coordination@incibe.esMedium 6.3
A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /clinic/patients_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.
- Product
- Online Clinic Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47367 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023RemoteClinic 2.0 is vulnerable to a time-based blind SQL injection attack in the 'start' GET parameter of patients/index.php.CVE-2023-33481 · Other software · remoteclinic · reported by MITRECritical 9.8
RemoteClinic 2.0 is vulnerable to a time-based blind SQL injection attack in the 'start' GET parameter of patients/index.php.
- Product
- remote_clinic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023RemoteClinic 2.0 contains a critical vulnerability chain that can be exploited by a remote attacker with low-privileged user credentials to create admin users, CVE-2023-33480 · Other software · remoteclinic · reported by MITREHigh 8.8
RemoteClinic 2.0 contains a critical vulnerability chain that can be exploited by a remote attacker with low-privileged user credentials to create admin users, escalate privileges, and execute arbitrary code on the target system via a PHP shell. The vulnerabilities are caused by a lack of input validation and access control in the staff/register.php endpoint and the edit-my-profile.php page. By sending a series of specially crafted requests to the RemoteClinic application, an attacker can create admin users with more privileges than their own, upload a PHP file containing arbitrary code, and execute arbitrary commands via the PHP shell.
- Product
- remote_clinic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023RemoteClinic version 2.0 contains a SQL injection vulnerability in the /staff/edit.php file.CVE-2023-33479 · Other software · remoteclinic · reported by MITRECritical 9.8
RemoteClinic version 2.0 contains a SQL injection vulnerability in the /staff/edit.php file.
- Product
- remote_clinic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023RemoteClinic 2.0 has a SQL injection vulnerability in the ID parameter of /medicines/stocks.php.CVE-2023-33478 · Other software · remoteclinic · reported by MITRECritical 9.8
RemoteClinic 2.0 has a SQL injection vulnerability in the ID parameter of /medicines/stocks.php.
- Product
- remote_clinic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023An issue in rmc R Beauty CLINIC Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.CVE-2023-38848 · Other software · Linecorp · reported by MITREHigh 7.5
An issue in rmc R Beauty CLINIC Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Apr 18, 2023Vulnerability in the Oracle Clinical Remote Data Capture product of Oracle Health Sciences Applications (component: Forms).CVE-2023-21993 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle Clinical Remote Data Capture product of Oracle Health Sciences Applications (component: Forms). The supported version that is affected is 5.4.0.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Clinical Remote Data Capture. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Clinical Remote Data Capture accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
- Product
- Clinical Remote Data Capture Option
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requirCVE-2023-25931 · Other software · Medtronic · reported by security@medtronic.comMedium 6.4
Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requires a security update to fix. Not updating could potentially result in unauthorized control of the clinician therapy application, which has greater control over therapy parameters than the patient app. Changes still cannot be made outside of the established therapy parameters of the programmer. For unauthorized access to occur, an individual would need physical access to the Smart Programmer.
- Product
- InsterStim Applications
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordglobal.medtronic.comglobal.medtronic.com
Feb 27, 2023MV iDigital Clinic Enterprise (iDCE) 1.0 stores passwords in cleartext.CVE-2022-31405 · Other software · MV Idigital Clinic Enterprise Project · reported by MITREMedium 6.5
MV iDigital Clinic Enterprise (iDCE) 1.0 stores passwords in cleartext.
- Product
- MV Idigital Clinic Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2023Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinicCVE-2023-22377 · Other software · FUJITSU LIMITED · reported by vultures@jpcert.or.jpHigh 7.4
Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinical Metadata Desktop Tools Version 1.0.3 to Version 1.1.0. If this vulnerability is exploited, an attacker may obtain an arbitrary file which meets a certain condition by reading a specially crafted XML file.
- Product
- tsClinical Define.xml Generator and tsClinical Metadata Desktop Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023SQL Injection vulnerability in RemoteClinic 2.0 allows attackers to execute arbitrary commands and gain sensitive information via the id parameter to /medicinesCVE-2022-48152 · Other software · Remoteclinic · reported by MITRECritical 9.8
SQL Injection vulnerability in RemoteClinic 2.0 allows attackers to execute arbitrary commands and gain sensitive information via the id parameter to /medicines/profile.php.
- Product
- Remote Clinic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in uCVE-2022-40471 · Other software · Oretnom23 · reported by MITRECritical 9.8
Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php
- Product
- Clinic's Patient Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Sep 2, 2022Clinic's Patient Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pms/update_patient.php.CVE-2022-36609 · Other software · Oretnom23 · reported by MITRECritical 9.8
Clinic's Patient Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pms/update_patient.php.
- Product
- Clinic's Patient Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2022Clinic's Patient Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via patients.php.CVE-2022-36251 · Other software · Oretnom23 · reported by MITREMedium 6.1
Clinic's Patient Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via patients.php.
- Product
- Clinic's Patient Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2022Clinic's Patient Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via update_medicine_details.php.CVE-2022-35117 · Other software · Oretnom23 · reported by MITREMedium 4.8
Clinic's Patient Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via update_medicine_details.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Packing text box under the Update Medical Details module.
- Product
- Clinic's Patient Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022Clinic's Patient Management System v1.0 is vulnerable to SQL Injection via /pms/update_medicine.php?id=.CVE-2022-36242 · Other software · Oretnom23 · reported by MITRECritical 9.8
Clinic's Patient Management System v1.0 is vulnerable to SQL Injection via /pms/update_medicine.php?id=.
- Product
- Clinic's Patient Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Clinic's Patient Management System v1.0 is vulnerable to SQL injection via /pms/update_user.php?id=.CVE-2022-36750 · Other software · Oretnom23 · reported by MITRECritical 9.8
Clinic's Patient Management System v1.0 is vulnerable to SQL injection via /pms/update_user.php?id=.
- Product
- Clinic's Patient Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.