CVE-2026-107260

MediumCVSS 6.5/10Last modified Nov 6, 2026

Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
DrupalSector Distribution>= 0.0.0, < 10.3.3; >= 10.4.0, < 10.4.2

References

Timeline

Published
Oct 30, 2026
Last modified
Nov 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1072614.2Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication BypassCVE-2026-1072625.3Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects AdvancedCVE-2026-1072635.4Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.1CVE-2026-1072645.4Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. CVE-2026-1072655.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. ThisCVE-2026-1072665.3Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2CVE-2026-1072675.3Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1CVE-2026-1072684.3Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows ForcefCVE-2026-1072693.7Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate vCVE-2026-107277.2An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker CVE-2026-1072707.1Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' CVE-2026-1072715.3Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofi
CVE-2026-107260: Medium severity, CVSS 6.5 | Vulnix