CVE-2024-54998

MediumCVSS 5.4

Published: 10/01/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

MonicaHQ version 4.1.2 was found to have an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create.

Risk Assessment

An authenticated attacker can inject malicious JavaScript code, potentially leading to session theft, account takeover, or data leakage of other users.

Recommendation

Update MonicaHQ to the latest version and implement input validation and encoding for the Reason parameter.

Original NVD description (English source)

MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create.