CVE-2024-54998 is an authenticated client-side injection vulnerability affecting MonicaHQ version 4.1.2. The vulnerability exists in the Reason parameter of the /people/h:[id]/debts/create endpoint, allowing an authenticated user to inject malicious input that could lead to limited confidentiality and integrity impacts. The vulnerability is categorized as CWE-79, which involves improper neutralization of input during web page generation. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impacts with no availability impact.

An authenticated attacker can exploit this vulnerability to inject malicious content via the Reason parameter, potentially leading to limited confidentiality and integrity compromise within the application context. There is no indication of availability impact. The medium CVSS score reflects moderate risk due to the requirement for authentication and the limited impact scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint to trusted users only and validate or sanitize input on the Reason parameter to mitigate injection risks.