CVE-2023-1094

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/food` endpoint and food parameter.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-10955.5In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_des CVE-2023-10969.8SnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a remote unauthenticated CVE-2023-10979.8Baicells EG7035-M11 devices with firmware through BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injection CVE-2023-10984.9An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all ver CVE-2023-10999.8A vulnerability was found in SourceCodester Online Student Management System 1.0. It has been rated as critical. Affected by this issue is s CVE-2023-11009.8A vulnerability classified as critical has been found in SourceCodester Online Catering Reservation System 1.0. This affects an unknown part CVE-2023-11018.8SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use excessive MFA codes.CVE-2023-11045.4Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-11058.1External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-11066.1Cross-site Scripting (XSS) - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-11075.4Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-11087.5A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslCo