CVE-2024-54996
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
MonicaHQ version 4.1.2 was found to contain multiple authenticated Client-Side Injection vulnerabilities. The flaws exist in the title and description parameters at the /people/ID/reminders/create endpoint.
Risk Assessment
An authenticated attacker can inject malicious JavaScript code, potentially leading to session theft, content manipulation, or further attacks against other users.
Recommendation
Update MonicaHQ to the latest version and apply proper input encoding or sanitization for the title and description parameters.
Other vulnerabilities in MonicaHQ
See all- CVE-2024-54999Medium
MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter in the General Information module.
- CVE-2024-54998Medium
MonicaHQ version 4.1.2 was found to have an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create.
- CVE-2024-54997Medium
MonicaHQ version 4.1.1 was found to have an authenticated Client-Side Injection vulnerability. The flaw exists in the entry text field at /journal/entries/ID/edit.
- CVE-2024-54994Medium
MonicaHQ version 4.1.2 was found to contain multiple Client-Side Injection vulnerabilities. The flaws exist in the first_name and last_name parameters of the Add a new relationship feature.
Original NVD description (English source)
MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description parameters at /people/ID/reminders/create.