https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-26747.htmlhttps://patchthecve.com/cve/CVE-2026-26747.htmlWed, 17 Jun 2026 10:26:19 +0000CRITICAL 9.1: A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.force_url" is not set and default is "false". The application generates absolute URLs (suchhttps://patchthecve.com/cve/CVE-2024-54951.htmlhttps://patchthecve.com/cve/CVE-2024-54951.htmlWed, 17 Jun 2026 08:10:50 +0000MEDIUM 5.4: Monica 4.1.2 is vulnerable to Cross Site Scripting (XSS). A malicious user can create a malformed contact and use that contact in the "HOW YOU MET" customization options to trigger the XSS.https://patchthecve.com/cve/CVE-2024-54999.htmlhttps://patchthecve.com/cve/CVE-2024-54999.htmlSun, 05 Jul 2026 01:21:12 +0000MEDIUM 6.5: MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter the General Information module.https://patchthecve.com/cve/CVE-2024-54998.htmlhttps://patchthecve.com/cve/CVE-2024-54998.htmlSun, 05 Jul 2026 01:21:11 +0000MEDIUM 5.4: MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create.https://patchthecve.com/cve/CVE-2024-54997.htmlhttps://patchthecve.com/cve/CVE-2024-54997.htmlSun, 05 Jul 2026 01:21:11 +0000MEDIUM 5.4: MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at /journal/entries/ID/edit.https://patchthecve.com/cve/CVE-2024-54996.htmlhttps://patchthecve.com/cve/CVE-2024-54996.htmlSun, 05 Jul 2026 01:21:10 +0000HIGH 8.8: MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description parameters at /people/ID/reminders/create.https://patchthecve.com/cve/CVE-2024-54994.htmlhttps://patchthecve.com/cve/CVE-2024-54994.htmlSun, 05 Jul 2026 01:21:10 +0000MEDIUM 6.5: MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_name parameters in the Add a new relationship feature.