CVE-2024-54997

MediumCVSS 5.4

Published: 10/01/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

MonicaHQ version 4.1.1 was found to have an authenticated Client-Side Injection vulnerability. The flaw exists in the entry text field at /journal/entries/ID/edit.

Risk Assessment

An authenticated attacker can inject malicious JavaScript code, potentially leading to session theft, content modification, or other attacks against users viewing the entries.

Recommendation

Update MonicaHQ to the latest patched version. Until then, restrict access to the entry editing feature to trusted users only.

Original NVD description (English source)

MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at /journal/entries/ID/edit.