CVE-2024-54999

MediumCVSS 6.5

Published: 13/01/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

31th percentile - higher than 31% of all known CVEs

MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter in the General Information module.

An attacker can inject malicious JavaScript code, leading to session theft, account takeover, or user data leakage.

Immediately update MonicaHQ to the latest version and implement input validation and sanitization for the last_name parameter.

Original NVD description (English source)

MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter the General Information module.