–
Not scored
CVE-2026-107260
Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229
Sector Distribution · Cross-site scripting · CWE-79AffectedSector Distribution
FixUpdate to 10.3.3, 10.4.2 or newer
PublishedOct 30, 03:09 · drupal
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:04 UTC
What we know
No known exploitation. CISA KEV, checked 22:04 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.
Description
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.
From drupal
Affected and fixed versions
ProductAffectedFixed inSector Distribution0.0.0 – before 10.3.310.3.3Sector Distribution10.4.0 – before 10.4.210.4.2
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known