5 matches found
CVE-2021-27371
The Contact page in Monica 2.19.1 allows stored XSS via the Description field...
CVE-2024-54951
Monica version 4.1.2 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. A malicious user can create a malformed contact—specifically by injecting XSS payloads into all name fields using double quotes—and then select that contact within the "HOW YOU MET" customization options. Thi...
Monica 安全漏洞
Monica is an AI assistant from Monica Inc. A security vulnerability exists in Monica version 4.1.2 that originates from a malicious user being able to create a contact that is formatted incorrectly and use it in the HOW YOU MET customization option to trigger cross-site scripting...
PT-2023-31568 · Monica · Monica
Name of the Vulnerable Software and Affected Versions: Monica aka MonicaHQ version 4.0.0 Description: A stored cross-site scripting XSS vulnerability exists in the software via an SVG document uploaded by an authenticated user. Recommendations: For version 4.0.0, consider restricting the upload o...
