GCVE - cpe:2.3:a:monicahq:monica:4.1.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:monicahq:monica:4.1.2:*:*:*:*:*:*:*

part: a version: 4.1.2 update: *

Vendor	Monicahq (`41147f40-bc54-55d0-8c20-327cf6c32245`)
Product	Monica (`e7a70aae-8711-507d-bfa1-49cd95ed93a8`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:docker/monica`	purl2cpe	2026-06-01 10:12:52.467837
`pkg:github/monicahq/monica`	purl2cpe	2026-06-01 10:12:52.467838

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-26747`	vulnerable	2026-06-08 07:53:21.702725	Details available A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.force_url" is not set and default is "false". The application generates absolute URLs (such as those used in password reset emails) using the user-supplied Host header. This allows remote attackers to poison the password reset link sent to a victim, Published: 2026-02-20T00:00:00.000Z Updated: 2026-02-23T20:37:29.313Z Open on db.gcve.eu Reference links https://github.com/monicahq/monica https://github.com/hungnqdz/cve-research/blob/main/CVE-2026-26747.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-54999`	vulnerable	2026-06-08 06:54:16.891241	Details available MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter the General Information module. Published: 2025-01-13T00:00:00.000Z Updated: 2026-07-05T00:54:09.392Z Open on db.gcve.eu Reference links https://github.com/p314dO/CVEs/tree/main/CVE-2024-54999	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-54998`	vulnerable	2026-06-08 06:54:16.890914	Details available MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create. Published: 2025-01-10T00:00:00.000Z Updated: 2026-07-05T00:53:21.192Z Open on db.gcve.eu Reference links https://github.com/p314dO/CVEs/tree/main/CVE-2024-54998	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-54996`	vulnerable	2026-06-08 06:54:16.880326	Details available MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description parameters at /people/ID/reminders/create. Published: 2025-01-10T00:00:00.000Z Updated: 2026-07-05T00:53:13.067Z Open on db.gcve.eu Reference links https://github.com/p314dO/CVEs/tree/main/CVE-2024-54996	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-54994`	vulnerable	2026-06-08 06:54:16.879915	Details available MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_name parameters in the Add a new relationship feature. Published: 2025-01-10T00:00:00.000Z Updated: 2026-07-05T00:53:09.099Z Open on db.gcve.eu Reference links https://github.com/p314dO/CVEs/tree/main/CVE-2024-54994	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-54951`	vulnerable	2026-06-08 06:54:16.872215	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.