CVE-2024-54994
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
MonicaHQ version 4.1.2 was found to contain multiple Client-Side Injection vulnerabilities. The flaws exist in the first_name and last_name parameters of the Add a new relationship feature.
Risk Assessment
An attacker can inject malicious JavaScript code, potentially leading to session theft, account takeover, or displaying fake content to users.
Recommendation
Immediately update MonicaHQ to the latest available version and apply input validation and encoding for the first_name and last_name parameters.
Other vulnerabilities in MonicaHQ
See all- CVE-2024-54999Medium
MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter in the General Information module.
- CVE-2024-54998Medium
MonicaHQ version 4.1.2 was found to have an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create.
- CVE-2024-54997Medium
MonicaHQ version 4.1.1 was found to have an authenticated Client-Side Injection vulnerability. The flaw exists in the entry text field at /journal/entries/ID/edit.
- CVE-2024-54996High
MonicaHQ version 4.1.2 was found to contain multiple authenticated Client-Side Injection vulnerabilities. The flaws exist in the title and description parameters at the /people/ID/reminders/create endpoint.
Original NVD description (English source)
MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_name parameters in the Add a new relationship feature.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS