CVE-2026-107308: Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211

Published Oct 30, 2026

Updated

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.

Event History

Oct 30, 2026

CVE Published

via MITRE·03:10 AM

Data Sourced

via MITRE·03:10 AM

DescriptionWeakness

Data Sourced

via NVD·04:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Country module versions are affected?

Affected versions are 0.0.0 through 2.1.3 and 2.2.0 through 2.2.1. The provided information does not identify an affected Drupal core version.

What access and conditions are required to exploit this issue?

The CVSS vector indicates network reachability, high attack complexity, high privileges, and user interaction are required. Exploitation can result in limited confidentiality and integrity impact, with no availability impact.

CVE-2026-107308: Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211

Event History

Frequently Asked Questions

Which Country module versions are affected?

What access and conditions are required to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which Country module versions are affected?

What access and conditions are required to exploit this issue?