Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    DRUPAL-CONTRIB-2026-211 (CVE-2026-107308)

    Vulnerability from drupal – Published: 2026-10-07 16:36 – Updated: 2026-10-07 16:36 – Source website
    VLAI
    Details

    The module Country provides a dedicated field type for Drupal core's official country list.

    The module does not sufficiently escape user input in its autocomplete widget, which can lead to a cross site scripting vulnerability.

    This vulnerability is mitigated by the fact that it can not occur out of the box with the Country module, additional module(s) or custom code is required.

    Credits
    Conrad Lara (cmlara) www.drupal.org/u/cmlara
    References
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c2.1.3 || \u003e=2.2.0 \u003c2.2.1"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/country"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c2.1.3"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "database_specific": {
            "constraint": "\u003e=2.2.0 \u003c2.2.1"
          },
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-107308"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/cmlara"
      ],
      "name": "Conrad Lara (cmlara)"
    }
  ],
  "details": "The module Country provides a dedicated field type for Drupal core\u0027s official country list.\n\nThe module does not sufficiently escape user input in its autocomplete widget, which can lead to a cross site scripting vulnerability.\n\nThis vulnerability is mitigated by the fact that it can not occur out of the box with the Country module, additional module(s) or custom code is required.",
  "id": "DRUPAL-CONTRIB-2026-211",
  "modified": "2026-10-07T16:36:17.000Z",
  "published": "2026-10-07T16:36:17.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-211"
    }
  ],
  "schema_version": "1.7.0"
}