CVE-2024-54994

MediumCVSS 6.5

Published: 10/01/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

21th percentile - higher than 21% of all known CVEs

Summary

MonicaHQ version 4.1.2 was found to contain multiple Client-Side Injection vulnerabilities. The flaws exist in the first_name and last_name parameters of the Add a new relationship feature.

Risk Assessment

An attacker can inject malicious JavaScript code, potentially leading to session theft, account takeover, or displaying fake content to users.

Recommendation

Immediately update MonicaHQ to the latest available version and apply input validation and encoding for the first_name and last_name parameters.

Original NVD description (English source)

MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_name parameters in the Add a new relationship feature.