CVE-2025-4415 | Medium | 4.8 | 2025-05-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This i… |
CVE-2023-6923 | Medium | 6.1 | 2024-02-29 | The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all v… |
CVE-2022-33156 | Medium | 6.1 | 2022-07-12 | The matomo_integration (aka Matomo Integration) extension before 1.3.2 for TYPO3 allows XSS. |
CVE-2020-29578 | Critical | 9.8 | 2020-12-08 | The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user. Systems using the Piwik Docker container deploye… |
CVE-2013-0195 | Medium | 6.1 | 2019-11-20 | Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a diffe… |
CVE-2013-0194 | Medium | 6.1 | 2019-11-20 | Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a diffe… |
CVE-2013-0193 | Medium | 6.1 | 2019-11-20 | Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a diffe… |
CVE-2019-12215 | Medium | 4.3 | 2019-05-20 | A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the dis… |
CVE-2015-7816 | | | 2015-11-16 | The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, con… |
CVE-2015-7815 | | | 2015-11-16 | Directory traversal vulnerability in core/ViewDataTable/Factory.php in Piwik before 2.15.0 allows remote attackers to include and execute arbitrary local files… |
CVE-2013-2633 | | | 2013-03-21 | Piwik before 1.11 accepts input from a POST request instead of a GET request in unspecified circumstances, which might allow attackers to obtain sensitive info… |
CVE-2013-1844 | | | 2013-03-21 | Cross-site scripting (XSS) vulnerability in Piwik before 1.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2012-4541 | | | 2012-11-19 | Cross-site scripting (XSS) vulnerability in Piwik before 1.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2011-4941 | | | 2012-09-18 | Unspecified vulnerability in Piwik 1.2 through 1.4 allows remote attackers with the view permission to execute arbitrary code via unknown attack vectors. |
CVE-2011-3791 | | | 2011-09-24 | Piwik 1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message… |
CVE-2011-0401 | | | 2011-01-10 | Piwik before 1.1 does not properly limit the number of files stored under tmp/sessions/, which might allow remote attackers to cause a denial of service (inode… |
CVE-2011-0400 | | | 2011-01-10 | Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture t… |
CVE-2011-0399 | | | 2011-01-10 | Piwik before 1.1 does not prevent the rendering of the login form inside a frame in a third-party HTML document, which makes it easier for remote attackers to… |
CVE-2011-0398 | | | 2011-01-10 | The Piwik_Common::getIP function in Piwik before 1.1 does not properly determine the client IP address, which allows remote attackers to bypass intended geoloc… |
CVE-2011-0004 | | | 2011-01-10 | Multiple cross-site scripting (XSS) vulnerabilities in Piwik before 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2010-2786 | | | 2010-08-02 | Directory traversal vulnerability in Piwik 0.6 through 0.6.3 allows remote attackers to include arbitrary local files and possibly have unspecified other impac… |
CVE-2010-1453 | | | 2010-05-07 | Cross-site scripting (XSS) vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the… |
CVE-2009-4137 | | | 2009-12-24 | The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize functi… |
CVE-2009-4140 | | | 2009-12-22 | Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3… |
CVE-2009-1085 | | | 2009-03-25 | Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key… |