CVE-2024-54994 identifies multiple client-side injection (Cross-site Scripting) vulnerabilities in MonicaHQ version 4.1.2. The injection points are the first_name and last_name parameters within the Add a new relationship feature. This allows an attacker to inject malicious scripts that could be executed in the context of a victim's browser. The vulnerability has a CVSS 3.1 score of 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity. No patch or official fix information is currently available.

Successful exploitation could lead to unauthorized script execution in the context of the affected user's browser, potentially resulting in data disclosure or manipulation of client-side data. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or sanitization on the affected parameters as a temporary mitigation. Monitor vendor channels for updates regarding patches or official mitigations.