What is the CVSS score of CVE-2026-25022?

CVE-2026-25022 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Iqonic Design KiviCare are affected by CVE-2026-25022?

A high-severity SQL injection vulnerability in KiviCare clinic management system (versions ≤3.6.16) allows attackers to extract sensitive patient and operational data without detection.

How to fix or mitigate CVE-2026-25022?

Within 24 hours: inventory all KiviCare deployments and assess if patient data is actively processed; notify legal/compliance teams of potential PHI exposure. Within 7 days: implement WAF rules blocking SQL injection patterns, restrict database user permissions to minimum required access, and enable comprehensive audit logging of database queries. Within 30 days: evaluate migration to patched KiviCare version or alternative vendor solution; conduct forensic audit for evidence of exploitation.

Iqonic Design KiviCare CVE-2026-25022

HIGH

SQL Injection (CWE-89)

2026-02-03 audit@patchstack.com

SQLi

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 03, 2026 - 15:16 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Blind SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.16.

AnalysisAI

Blind SQL injection in KiviCare clinic management system versions 3.6.16 and earlier allows authenticated attackers to execute arbitrary SQL queries over the network with no user interaction required. An attacker with valid credentials can exploit this vulnerability to extract sensitive data from the underlying database, though code execution is not possible. No patch is currently available for this HIGH severity vulnerability affecting the Iqonic Design product.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects Iqonic Design KiviCare kivicare-clinic-management-system. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Blind SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.16.

Affected ProductsAI

Product: Iqonic Design KiviCare kivicare-clinic-management-system.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.