CVE-2026-107260: Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229
Published Oct 30, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.
Affected Software
1 affected component
Drupal Sector Distribution>=0.0.0<=10.3.3, >=10.4.0<=10.4.2
Event History
Oct 30, 2026
CVE Published
via MITRE·03:09 AM
Data Sourced
via MITRE·03:09 AM
DescriptionWeakness
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 AM
DescriptionWeakness
Nov 6, 2026
Data Sourced
via NVD·04:17 PM
Severity
Frequently Asked Questions
1
Which Sector Distribution versions are affected?
Affected versions are 0.0.0 through 10.3.3 and 10.4.0 through 10.4.2. The provided data does not identify a fixed version.
2
What type of impact can exploitation have?
The issue is a stored cross-site scripting vulnerability. Malicious input can be stored and later rendered in a web page without proper neutralization.