PT-2025-3085 · Monicahq · Monicahq

Nicolas Gula · Published 2025-01-10 · Updated 2025-01-14 · CVE-2024-54994

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MonicaHQ version 4.1.2

Description The issue is related to multiple Client-Side Injection vulnerabilities found in MonicaHQ. These vulnerabilities occur via the first name and last name parameters in the Add a new relationship feature.

Recommendations For MonicaHQ version 4.1.2, consider disabling the Add a new relationship feature until a patch is available to prevent exploitation of the first name and last name parameters. Restrict access to these parameters to minimize the risk of exploitation. Avoid using the first name and last name parameters in the affected feature until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-54994

Affected Products

Monicahq

References · 8

• 🔥 https://github.com/p314dO/CVEs/tree/main/CVE-2024-54994 · Exploit
• https://osv.dev/vulnerability/CVE-2024-54994 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-54994 · Security Note
• http://monicahq.com · Note
• https://twitter.com/VulmonFeeds/status/1878081287795159152 · Twitter Post
• https://twitter.com/CVETracker/status/1878170198856863758 · Twitter Post
• https://t.me/cvedetector/15004 · Telegram Post
• https://twitter.com/CVEnew/status/1877818234705211531 · Twitter Post