CVE-2024-13297

CVE-2024-13297: Eloqua - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-063

Vendor Drupal

Product Eloqua

Weakness CWE-502 · Unsafe deserialization

Published January 9, 2025

Last update January 10, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15.

Key dates

02Disclosure timeline

January 9, 2025 CVE published

January 10, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-13297 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html AskarLabs — CWE-502 write-up Deserialization of Untrusted Data

Related vulnerabilities

04Related CVE

CVE-2026-65572 WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability CVE-2026-32465 WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability CVE-2026-66620 WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability CVE-2026-78276 WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability CVE-2026-27414 WordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vulnerability