CVE-2026-0946 - Vulnerability Details - OpenCVE

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (XSS).This issue affects AT Internet SmartTag: from 0.0.0 before 1.0.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Bordeaux-metropole	At Internet Smarttag
Drupal	At Internet Smarttag

Configuration 1 [-]

cpe:2.3:a:bordeaux-metropole:at_internet_smarttag:*:*:*:*:*:drupal:*:*

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2026-003

History

Wed, 11 Feb 2026 19:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Bordeaux-metropole Bordeaux-metropole at Internet Smarttag
CPEs		cpe:2.3:a:bordeaux-metropole:at_internet_smarttag::::::drupal::*
Vendors & Products		Bordeaux-metropole Bordeaux-metropole at Internet Smarttag

Fri, 06 Feb 2026 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 05 Feb 2026 11:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal at Internet Smarttag
Vendors & Products		Drupal Drupal at Internet Smarttag

Wed, 04 Feb 2026 20:45:00 +0000

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (XSS).This issue affects AT Internet SmartTag: from 0.0.0 before 1.0.1.
Title		AT Internet SmartTag - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-003
Weaknesses		CWE-79
References		https://www.drupal.org/sa-contrib-2026-003

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2026-02-04T20:25:39.200Z

Updated: 2026-02-06T20:35:38.434Z

Reserved: 2026-01-14T16:52:30.774Z

Link: CVE-2026-0946

Vulnrichment

Updated: 2026-02-06T20:35:34.895Z

NVD

Status : Analyzed

Published: 2026-02-04T21:15:58.907

Modified: 2026-02-11T19:19:34.760

Link: CVE-2026-0946

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0946", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-01-14T16:52:30.774Z", "datePublished": "2026-02-04T20:25:39.200Z", "dateUpdated": "2026-02-06T20:35:38.434Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/atsmarttag", "defaultStatus": "unaffected", "product": "AT Internet SmartTag", "repo": "https://git.drupalcode.org/project/atsmarttag", "vendor": "Drupal", "versions": [{"lessThan": "1.0.1", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff (prudloff)"}, {"lang": "en", "type": "remediation developer", "value": "Frank Mably (mably)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "datePublic": "2026-01-14T17:55:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (XSS).<p>This issue affects AT Internet SmartTag: from 0.0.0 before 1.0.1.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (XSS).This issue affects AT Internet SmartTag: from 0.0.0 before 1.0.1."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-02-04T20:25:39.200Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2026-003"}], "source": {"discovery": "UNKNOWN"}, "title": "AT Internet SmartTag - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-003", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-02-06T20:35:19.832501Z", "id": "CVE-2026-0946", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T20:35:38.434Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-0946", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-06T20:35:19.832501Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T20:35:34.895Z"}}], "cna": {"title": "AT Internet SmartTag - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-003", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff (prudloff)"}, {"lang": "en", "type": "remediation developer", "value": "Frank Mably (mably)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/atsmarttag", "vendor": "Drupal", "product": "AT Internet SmartTag", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.0.1", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/atsmarttag", "defaultStatus": "unaffected"}], "datePublic": "2026-01-14T17:55:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-003"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (XSS).This issue affects AT Internet SmartTag: from 0.0.0 before 1.0.1.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (XSS).<p>This issue affects AT Internet SmartTag: from 0.0.0 before 1.0.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-02-04T20:25:39.200Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0946", "state": "PUBLISHED", "dateUpdated": "2026-02-06T20:35:38.434Z", "dateReserved": "2026-01-14T16:52:30.774Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-02-04T20:25:39.200Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}