{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0947", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-01-14T16:52:31.950Z", "datePublished": "2026-02-04T20:25:50.871Z", "dateUpdated": "2026-02-04T21:24:09.075Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/pianoanalytics", "defaultStatus": "unaffected", "product": "AT Internet Piano Analytics", "repo": "https://git.drupalcode.org/project/pianoanalytics", "vendor": "Drupal", "versions": [{"lessThan": "1.0.1", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "2.3.1", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff (prudloff)"}, {"lang": "en", "type": "remediation developer", "value": "Frank Mably (mably)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}, {"lang": "en", "type": "coordinator", "value": "Pierre Rudloff (prudloff)"}], "datePublic": "2026-01-14T17:56:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scripting (XSS).<p>This issue affects AT Internet Piano Analytics: from 0.0.0 before 1.0.1, from 2.0.0 before 2.3.1.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scripting (XSS).This issue affects AT Internet Piano Analytics: from 0.0.0 before 1.0.1, from 2.0.0 before 2.3.1."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-02-04T20:25:50.871Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2026-004"}], "source": {"discovery": "UNKNOWN"}, "title": "AT Internet Piano Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-004", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T21:24:05.128353Z", "id": "CVE-2026-0947", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T21:24:09.075Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-0947", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T21:24:05.128353Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T21:23:59.427Z"}}], "cna": {"title": "AT Internet Piano Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-004", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff (prudloff)"}, {"lang": "en", "type": "remediation developer", "value": "Frank Mably (mably)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}, {"lang": "en", "type": "coordinator", "value": "Pierre Rudloff (prudloff)"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/pianoanalytics", "vendor": "Drupal", "product": "AT Internet Piano Analytics", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.0.1", "versionType": "semver"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.3.1", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/pianoanalytics", "defaultStatus": "unaffected"}], "datePublic": "2026-01-14T17:56:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-004"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scripting (XSS).This issue affects AT Internet Piano Analytics: from 0.0.0 before 1.0.1, from 2.0.0 before 2.3.1.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scripting (XSS).<p>This issue affects AT Internet Piano Analytics: from 0.0.0 before 1.0.1, from 2.0.0 before 2.3.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-02-04T20:25:50.871Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0947", "state": "PUBLISHED", "dateUpdated": "2026-02-04T21:24:09.075Z", "dateReserved": "2026-01-14T16:52:31.950Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-02-04T20:25:50.871Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bordeaux-metropole:at_internet_piano_analytics:*:*:*:*:*:drupal:*:*", "matchCriteriaId": "66D2F4BF-F84C-478B-B79B-76F1957C2F48", "versionEndExcluding": "1.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:bordeaux-metropole:at_internet_piano_analytics:*:*:*:*:*:drupal:*:*", "matchCriteriaId": "358AD460-489C-4165-868E-03B3D5DCC356", "versionEndExcluding": "2.3.1", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scripting (XSS).This issue affects AT Internet Piano Analytics: from 0.0.0 before 1.0.1, from 2.0.0 before 2.3.1."}], "id": "CVE-2026-0947", "lastModified": "2026-02-11T19:19:26.493", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-02-04T21:15:59.030", "references": [{"source": "mlhess@drupal.org", "tags": ["Vendor Advisory"], "url": "https://www.drupal.org/sa-contrib-2026-004"}], "sourceIdentifier": "mlhess@drupal.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "mlhess@drupal.org", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T13:44:53.600824+00:00", "value": {"mitigation_remediation": ["Upgrade the AT Internet Piano Analytics module to version 1.0.1 or later, or 2.3.1 or later, to remove the XSS flaw.", "If an immediate upgrade is not feasible, implement input filtering or deploy content\u2011security\u2011policy headers to block execution of injected scripts.", "After applying the recommended changes, monitor site traffic for unexpected script activity and verify that the module no longer reflects unsanitized input."], "summary": {"action": "Patch", "impact": "Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Drupal AT Internet Piano Analytics versions prior to 1.0.1 (from 0.0.0 up to, but not including, 1.0.1) and prior to 2.3.1 (from 2.0.0 up to, but not including, 2.3.1) are affected. The vulnerability applies to the module as deployed on any Drupal site that uses these versions.", "description_and_impact": "The vulnerability is an instance of improper neutralization of user input during web page generation, resulting in a Cross\u2011Site Scripting (XSS) flaw in the AT Internet Piano Analytics module for Drupal. The flaw allows an attacker to inject arbitrary client\u2011side code that will execute when the affected content is rendered in a user\u2019s browser. No explicit downstream consequences such as credential theft or session hijacking are documented in the official description, so the exact impact depends on how the module reflects user supplied data to page output.", "risk_and_exploitability": "The CVSS base score of 4.8 indicates a moderate severity, and the EPSS score of less than 1% signifies a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is not explicitly defined in the advisory; based on the nature of XSS, it is inferred that an attacker could exploit the flaw by submitting malicious input through a form field or by manipulating a URL parameter that is subsequently rendered, but such conditions are not specified in the official text."}}}}, "created": "2026-02-05T11:39:11.027525+00:00", "updated": "2026-04-18T13:45:45.683339+00:00", "vendors": ["drupal", "drupal$PRODUCT$at_internet_piano_analytics"]}