PT-2026-2980 · Drupal+2 · At Internet Piano Analytics+1

Frank Mably + 3 · Published 2026-01-14 · Updated 2026-02-04 · CVE-2026-0947

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal AT Internet Piano Analytics versions 0.0.0 through 1.0.0 Drupal AT Internet Piano Analytics versions 2.0.0 through 2.3.0

Description The AT Internet Piano Analytics module for Drupal contains a Cross-Site Scripting (XSS) issue. The module does not properly filter text entered by administrators, leading to a persistent XSS condition. An attacker must have the 'administer pianoanalytics' permission to exploit this.

Recommendations Update to version 1.0.1 or later. Update to version 2.3.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-0947

DRUPAL-CONTRIB-2026-004

Affected Products

At Internet Piano Analytics

Drupal/Pianoanalytics

References · 7

• https://osv.dev/vulnerability/CVE-2026-0947 · Vendor Advisory
• https://drupal.org/sa-contrib-2026-004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0947 · Security Note
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-004 · Vendor Advisory
• https://t.me/cveNotify/150919 · Telegram Post
• https://t.me/CVEtracker/43761 · Telegram Post
• https://twitter.com/CVEnew/status/2019182773228208268 · Twitter Post