Live › vulnerability › CVE-2026-114573
Monster Menus, a Drupal module, has a flaw that lets an attacker manipulate object attributes through untrusted input, which is the object injection class of bug. The sources do not state what an attacker can reach beyond that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites running the Monster Menus module at a version listed as affected (0.0.0 through 9.5.6). The sources do not say which configurations or user roles are needed to reach the flaw.
No product ranges from the sources yet.
drush pm:list --filter=monster_menus (unknown whether this exact command applies to the project)9.5.6 once the vendor publishes itEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-114573")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.