5 matches found
CVE-2021-27371
The Contact page in Monica 2.19.1 allows stored XSS via the Description field...
Monica security vulnerabilities
Monica is an AI assistant from Monica Inc. A security vulnerability exists in Monica version 4.1.2 that originates from a malicious user being able to create a contact that is formatted incorrectly and use it in the HOW YOU MET customization option to trigger cross-site scripting...
CVE-2024-54951
Monica version 4.1.2 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. A malicious user can create a malformed contact—specifically by injecting XSS payloads into all name fields using double quotes—and then select that contact within the "HOW YOU MET" customization options. Thi...
PT-2023-31568 · Monica · Monica
Name of the Vulnerable Software and Affected Versions: Monica aka MonicaHQ version 4.0.0 Description: A stored cross-site scripting XSS vulnerability exists in the software via an SVG document uploaded by an authenticated user. Recommendations: For version 4.0.0, consider restricting the upload o...
