CVE-2024-54951

Monica-Stored-XSS-Vulnerability CVE-2024-54951 CVE-2024-54951 我于2024年11月20日通过电子邮件联系了 Monica 开发团队。随后几周，我还尝试通过 LinkedIn 连接消息及其他平台联系他们。在等待3个月未收到回复后，在此发布。 Monica Docker v. 4.1.2 存储型 XSS 漏洞 1. 首先点击顶部面板的“联系人”按钮 2. 在右侧点击“添加联系人” 3. 将你的 XSS 载荷填入所有姓名字段（这些字段都存在漏洞）。需要使用双引号，单引号似乎会导致 Web 应用程序崩溃。 4...

CVE-2021-27371

The Contact page in Monica 2.19.1 allows stored XSS via the Description field...

CVE-2021-27559

The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field...

CVE-2026-26747

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.forceurl" is not set and default is "false". The application generates absolute URLs suc...

CVE-2026-26747

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.forceurl" is not set and default is "false". The application generates absolute URLs suc...

CVE-2026-26747

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.forceurl" is not set and default is "false". The application generates absolute URLs suc...

CVE-2026-26747

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.forceurl" is not set and default is "false". The application generates absolute URLs suc...

CVE-2026-26747

Monica version 4.1.2 is vulnerable to a Host Header Poisoning attack due to the improper handling of the HTTP Host header within the app/Providers/AppServiceProvider.php file. This issue is compounded by a default misconfiguration where the app.force_url parameter is not set and defaults to "fals...

CVE-2026-26747

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.forceurl" is not set and default is "false". The application generates absolute URLs suc...

CVE-2026-26747

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.forceurl" is not set and default is "false". The application generates absolute URLs suc...

PT-2026-21270

Name of the Vulnerable Software and Affected Versions Monica version 4.1.2 Description A Host Header Poisoning issue exists due to improper handling of the HTTP Host header in the file app/Providers/AppServiceProvider.php. This is combined with a default misconfiguration where app.force url is no...

Monica 安全漏洞

Monica is an AI assistant of the Monica company. Version 4.1.2 of Monica contains a security vulnerability, which stems from improper handling of HTTP headers, potentially leading to header poisoning attacks...

EUVD-2021-14126

Malware in sbrugna...

EUVD-2021-14128

Malware in sbrugna...

EUVD-2021-14127

Malware in sbrugna...

EUVD-2021-14129

Malware in sbrugna...

EUVD-2021-14310

Malware in sbrugna...

EUVD-2020-23323

Malware in sbrugna...

EUVD-2024-52715

Malicious code in bioql PyPI...

CVE-2024-45989

Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. A prompt injection allows an attacker to modify chatbot answer with an unloaded image that exfiltrates the user's sensitive chat data of the current session to a malicious...