CVE-2024-54999
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter in the General Information module.
Risk Assessment
An attacker can inject malicious JavaScript code, leading to session theft, account takeover, or user data leakage.
Recommendation
Immediately update MonicaHQ to the latest version and implement input validation and sanitization for the last_name parameter.
Other vulnerabilities in MonicaHQ
See all- CVE-2024-54998Medium
MonicaHQ version 4.1.2 was found to have an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create.
- CVE-2024-54997Medium
MonicaHQ version 4.1.1 was found to have an authenticated Client-Side Injection vulnerability. The flaw exists in the entry text field at /journal/entries/ID/edit.
- CVE-2024-54996High
MonicaHQ version 4.1.2 was found to contain multiple authenticated Client-Side Injection vulnerabilities. The flaws exist in the title and description parameters at the /people/ID/reminders/create endpoint.
- CVE-2024-54994Medium
MonicaHQ version 4.1.2 was found to contain multiple Client-Side Injection vulnerabilities. The flaws exist in the first_name and last_name parameters of the Add a new relationship feature.
Original NVD description (English source)
MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter the General Information module.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS