PT-2025-5626

CVE-2025-54997

Published

2025-01-20

Updated

2026-07-27

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: MonicaHQ version 4.1.1

Description: The issue allows attackers to exploit authenticated client-side injection in journal entry edits, with a medium severity level. A patch is pending, and users should monitor updates closely.

Recommendations: For version 4.1.1, update to a newer version once the pending patch is released to resolve the issue. As a temporary workaround, consider restricting access to journal entry edits until the patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Cipherboy

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers

CVE-2025-54997