Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Feb 20, 2026A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined CVE-2026-26747 · Other software · Monicahq · reported by MITRECritical 9.1
A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.force_url" is not set and default is "false". The application generates absolute URLs (such as those used in password reset emails) using the user-supplied Host header. This allows remote attackers to poison the password reset link sent to a victim,
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025Monica 4.1.2 is vulnerable to Cross Site Scripting (XSS).CVE-2024-54951 · Other software · Monicahq · reported by MITREMedium 5.4
Monica 4.1.2 is vulnerable to Cross Site Scripting (XSS). A malicious user can create a malformed contact and use that contact in the "HOW YOU MET" customization options to trigger the XSS.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter the General Information module.CVE-2024-54999 · Other software · Monicahq · reported by MITREMedium 6.5
MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter the General Information module.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create.CVE-2024-54998 · Other software · Monicahq · reported by MITREMedium 5.4
MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at /journal/entries/ID/edit.CVE-2024-54997 · Other software · Monicahq · reported by MITREMedium 5.4
MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at /journal/entries/ID/edit.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description parameters at /people/ID/reCVE-2024-54996 · Other software · Monicahq · reported by MITREHigh 8.8
MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description parameters at /people/ID/reminders/create.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_name parameters in the Add a new relationshCVE-2024-54994 · Other software · Monicahq · reported by MITREMedium 6.5
MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_name parameters in the Add a new relationship feature.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica ChatGPT AI Assistant v2.4.0 allows attackers to access and exfiltrate all preCVE-2024-48142 · Other software · butterflyeffectpte · reported by MITREHigh 7.5
A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica ChatGPT AI Assistant v2.4.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
- Product
- monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 v6.3.0 allows attackers to access and exfCVE-2024-48140 · Other software · butterflyeffectpte · reported by MITREHigh 7.5
A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 v6.3.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
- Product
- monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromewebstore.google.comgithub.com
Sep 26, 2024Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor.CVE-2024-45989 · Other software · butterflyeffectpte · reported by MITREMedium 4
Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. A prompt injection allows an attacker to modify chatbot answer with an unloaded image that exfiltrates the user's sensitive chat data of the current session to a malicious third-party or attacker-controlled server.
- Product
- monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2023A stored cross-site scripting (XSS) vulnerability exists in Monica (aka MonicaHQ) 4.0.0 via an SVG document uploaded by an authenticated user.CVE-2023-50465 · Other software · Monicahq · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability exists in Monica (aka MonicaHQ) 4.0.0 via an SVG document uploaded by an authenticated user.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/relationships` endpoint aCVE-2023-30790 · Other software · Monicahq · reported by help@fluidattacks.comMedium 5.4
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/relationships` endpoint and first_name and last_name parameter.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.commonicahq.com
May 8, 2023MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/work` endpoint and job anCVE-2023-30789 · Other software · Monicahq · reported by help@fluidattacks.comMedium 5.4
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/work` endpoint and job and company parameter.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.commonicahq.com
May 8, 2023MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people/add` endpoint and nickName, CVE-2023-30788 · Other software · Monicahq · reported by help@fluidattacks.comMedium 5.4
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people/add` endpoint and nickName, description, lastName, middleName and firstName parameter.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.commonicahq.com
May 8, 2023MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/introductions` endpoint aCVE-2023-30787 · Other software · Monicahq · reported by help@fluidattacks.comMedium 5.4
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/introductions` endpoint and first_met_additional_info parameter.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.commonicahq.com
May 8, 2023MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/food` endpoint and food pCVE-2023-1094 · Other software · Monicahq · reported by help@fluidattacks.comHigh 8.8
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/food` endpoint and food parameter.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.commonicahq.com
May 8, 2023MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `settings` endpoint and first_name pCVE-2023-1031 · Other software · Monicahq · reported by help@fluidattacks.comHigh 8.8
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `settings` endpoint and first_name parameter.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.commonicahq.com
Apr 14, 2021Cross Site Scripting (XSS) in Monica before 2.19.1 via the journal page.CVE-2020-35660 · Other software · Monicahq · reported by MITREMedium 5.4
Cross Site Scripting (XSS) in Monica before 2.19.1 via the journal page.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2021The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field.CVE-2021-27559 · Other software · Monicahq · reported by MITREMedium 5.4
The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2021The Contact page in Monica 2.19.1 allows stored XSS via the Description field.CVE-2021-27371 · Other software · Monicahq · reported by MITREMedium 5.4
The Contact page in Monica 2.19.1 allows stored XSS via the Description field.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2021The Contact page in Monica 2.19.1 allows stored XSS via the Last Name field.CVE-2021-27370 · Other software · Monicahq · reported by MITREMedium 5.4
The Contact page in Monica 2.19.1 allows stored XSS via the Last Name field.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 22, 2021The Contact page in Monica 2.19.1 allows stored XSS via the Middle Name field.CVE-2021-27369 · Other software · Monicahq · reported by MITREMedium 5.4
The Contact page in Monica 2.19.1 allows stored XSS via the Middle Name field.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2021The Contact page in Monica 2.19.1 allows stored XSS via the First Name field.CVE-2021-27368 · Other software · Monicahq · reported by MITREMedium 5.4
The Contact page in Monica 2.19.1 allows stored XSS via the First Name field.
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.