CVE-2021-27370

This exploit demonstrates a stored XSS vulnerability in Monica 2.19.1 by injecting a malicious payload into the 'last_name' field, which executes JavaScript when rendered. The payload uses constructor.constructor to bypass input validation and trigger an alert with the document.cookie.