MonicaHQ vulnerabilities
We track 4 vulnerabilities in MonicaHQ products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on February 20, 2026.
Latest MonicaHQ vulnerabilities
- 9.1 Critical severity
Monica: Improper Neutralization of HTTP Headers for Scripting Syntax
A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.force_url" is not set and default is "false". The a
- 8.8 High severity
Monica: Improper Neutralization of Input During Web Page Generation
MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description parameters at /people/ID/reminders/create.
- 8.8 High severity
MonicaHQ: Improper Neutralization of Input During Web Page Generation
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/food` endpoint and food parameter.
- 8.8 High severity
MonicaHQ: Improper Neutralization of Input During Web Page Generation
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `settings` endpoint and first_name parameter.