Matomo vulnerabilities

Products

• Matomo 22

Newest

• drupal piwik pro Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058 CVE-2025-4415 Fix available 4.8 MediumMay 14, 2025
• matomo, matomoteam matomo analytics – powerful, privacy-first insights for wordpress +1 more Matomo <= 4.15.3 - Reflected Cross-Site Scripting via idsite CVE-2023-6923 6.1 MediumFebruary 20, 2024
• matomo integration brotkrueml/typo3-matomo-integration vulnerable to Cross-Site Scripting CVE-2022-33156 Fix available 6.1 MediumJune 17, 2022
• matomo piwik fpm-alpine docker image The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for... CVE-2020-29578 9.8 CriticalDecember 8, 2020
• piwik, matomo +1 more Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web... CVE-2013-0195 6.1 MediumNovember 20, 2019
• piwik, matomo +1 more Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web... CVE-2013-0194 6.1 MediumNovember 20, 2019
• piwik, matomo +1 more Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web... CVE-2013-0193 6.1 MediumNovember 20, 2019
• matomo ** DISPUTED ** A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user... CVE-2019-12215 Disputed 4.3 MediumMay 20, 2019
• matomo The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows... CVE-2015-7816 7.5 HighNovember 16, 2015
• matomo Directory traversal vulnerability in core/ViewDataTable/Factory.php in Piwik before 2.15.0 allows... CVE-2015-7815 7.5 HighNovember 16, 2015
• matomo Piwik (now Matomo) Reveals Sensitive Information by Accepting Input from `POST` Requests CVE-2013-2633 Fix available 5.0 MediumMarch 21, 2013
• matomo Piwik (now Matomo) Vulnerable to Cross-Site Scripting (XSS) CVE-2013-1844 Fix available 4.3 MediumMarch 21, 2013
• matomo Cross-site scripting (XSS) vulnerability in Piwik before 1.9 allows remote attackers to inject... CVE-2012-4541 4.3 MediumNovember 19, 2012
• matomo Piwik (now Matomo) Vulnerable to Arbitrary Code Execution CVE-2011-4941 Fix available 6.8 MediumSeptember 18, 2012
• matomo Piwik 1.1 allows remote attackers to obtain sensitive information via a direct request to a .php... CVE-2011-3791 5.0 MediumSeptember 24, 2011
• matomo Piwik before 1.1 does not properly limit the number of files stored under tmp/sessions/, which... CVE-2011-0401 5.0 MediumJanuary 10, 2011
• matomo Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https... CVE-2011-0400 5.0 MediumJanuary 10, 2011
• matomo Piwik before 1.1 does not prevent the rendering of the login form inside a frame in a third-party... CVE-2011-0399 4.3 MediumJanuary 10, 2011
• matomo The Piwik_Common::getIP function in Piwik before 1.1 does not properly determine the client IP... CVE-2011-0398 6.4 MediumJanuary 10, 2011
• matomo Multiple cross-site scripting (XSS) vulnerabilities in Piwik before 1.1 allow remote attackers to... CVE-2011-0004 4.3 MediumJanuary 10, 2011
• matomo Directory traversal vulnerability in Piwik 0.6 through 0.6.3 allows remote attackers to include... CVE-2010-2786 6.8 MediumAugust 2, 2010
• piwik, matomo +1 more Cross-site scripting (XSS) vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows... CVE-2010-1453 Public exploit 4.3 MediumMay 7, 2010
• matomo The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate... CVE-2009-4137 Public exploit EPSS 16.9% 7.5 HighDecember 24, 2009
• teethgrinder.co.uk open flash chart, matomo +1 more Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1... CVE-2009-4140 Public exploit EPSS 75.8% 7.5 HighDecember 22, 2009
• matomo Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access... CVE-2009-1085 5.0 MediumMarch 25, 2009