CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 13/01/2025 |
| CVE-2024-54998 | 中危5.4 | MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create. | 10/01/2025 |
| CVE-2024-54997 | 中危5.4 | MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at /journal/entries/ID/edit. | 10/01/2025 |
| CVE-2024-54996 | 高危8.8 | MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description parameters at /people/ID/reminders/create. | 10/01/2025 |
| CVE-2024-54994 | 中危6.5 | MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_name parameters in the Add a new relationship feature. | 10/01/2025 |
| CVE-2023-50465 | 中危5.4 | A stored cross-site scripting (XSS) vulnerability exists in Monica (aka MonicaHQ) 4.0.0 via an SVG document uploaded by an authenticated user. | 11/12/2023 |
| CVE-2023-30790 | 中危5.4 | MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/relationships` endpoint and first_name and last_name parameter. | 08/05/2023 |
| CVE-2023-30789 | 中危5.4 | MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/work` endpoint and job and company parameter. | 08/05/2023 |
| CVE-2023-30788 | 中危5.4 | MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people/add` endpoint and nickName, description, lastName, middleName and firstName parameter. | 08/05/2023 |
| CVE-2023-30787 | 中危5.4 | MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/introductions` endpoint and first_met_additional_info parameter. | 08/05/2023 |
| CVE-2023-1094 | 高危8.8 | MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/food` endpoint and food parameter. | 08/05/2023 |
| CVE-2023-1031 | 高危8.8 | MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `settings` endpoint and first_name parameter. | 08/05/2023 |
| CVE-2020-35660 | 中危5.4 | Cross Site Scripting (XSS) in Monica before 2.19.1 via the journal page. | 14/04/2021 |
| CVE-2021-27559 | 中危5.4 | The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field. | 22/02/2021 |
| CVE-2021-27371 | 中危5.4 | The Contact page in Monica 2.19.1 allows stored XSS via the Description field. | 22/02/2021 |
| CVE-2021-27370 | 中危5.4 | The Contact page in Monica 2.19.1 allows stored XSS via the Last Name field. | 22/02/2021 |
| CVE-2021-27369 | 中危5.4 | The Contact page in Monica 2.19.1 allows stored XSS via the Middle Name field. | 22/02/2021 |
| CVE-2021-27368 | 中危5.4 | The Contact page in Monica 2.19.1 allows stored XSS via the First Name field. | 22/02/2021 |