First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-13299

MediumCVSS 6.6/10Last modified Jun 17, 2026

Description

Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework: *.*.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Drupal	Megamenu Framework	.

References

https://www.drupal.org/sa-contrib-2024-065Third Party Advisory

Timeline

Published: Jan 9, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-13304.3The kadence-blocks-pro WordPress plugin before 2.3.8 does not prevent users with at least the contributor role using some of its shortcode's CVE-2024-133006.6Vulnerability in Drupal Print Anything.This issue affects Print Anything: *.*.CVE-2024-133016.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single S CVE-2024-133025.3Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Acces CVE-2024-133035.3Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 CVE-2024-133044.5Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0 CVE-2024-133054.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-CVE-2024-133064.3The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which coul CVE-2024-133075.3The Reales WP - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized modification and loss of data due to a missing CVE-2024-133083.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cros CVE-2024-133095.4Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This i CVE-2024-13316.1The Team Members WordPress plugin before 5.3.2 does not validate and escape some of its shortcode attributes before outputting them back in

CVE-2024-13299: Medium severity, CVSS 6.6 | Vulnix