Skip to content
Noroxi

matomo records

25 published records for vendor matomo.

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 4%
Pre-auth RCE
5
With a fix record
20%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 20
  3. 22
  4. 24
  5. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

25 records
  • CVE-2009-4140
    53Plan

    Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0

    HighCVSS 7.5WeaponizedEPSS 75%

    teethgrinder.co.uk · open flash chartDec 22, 2009

  • CVE-2020-29578
    40Plan

    The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user.

    CriticalCVSS 9.8No exploitEPSS 2%

    matomo · piwik fpm-alpine docker imageDec 8, 2020

  • CVE-2009-4137
    35Monitor

    The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the

    HighCVSS 7.5Proof of conceptEPSS 16%

    matomo · matomoDec 24, 2009

  • CVE-2015-7816
    31Monitor

    The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object inj

    HighCVSS 7.5No exploitEPSS 3%

    matomo · matomoNov 16, 2015

  • CVE-2015-7815
    31Monitor

    Directory traversal vulnerability in core/ViewDataTable/Factory.php in Piwik before 2.15.0 allows remote attackers to include and execute ar

    HighCVSS 7.5No exploitEPSS 2%

    matomo · matomoNov 16, 2015

  • CVE-2010-2786
    28Monitor

    Directory traversal vulnerability in Piwik 0.6 through 0.6.3 allows remote attackers to include arbitrary local files and possibly have unsp

    MediumCVSS 6.8No exploitEPSS 2%

    matomo · matomoAug 2, 2010

  • CVE-2011-4941
    28Monitor

    Unspecified vulnerability in Piwik 1.2 through 1.4 allows remote attackers with the view permission to execute arbitrary code via unknown at

    MediumCVSS 6.8No exploitEPSS 2%

    matomo · matomoSep 18, 2012

  • CVE-2011-0398
    25Monitor

    The Piwik_Common::getIP function in Piwik before 1.1 does not properly determine the client IP address, which allows remote attackers to byp

    MediumCVSS 6.4No exploitEPSS 1%

    matomo · matomoJan 10, 2011

  • CVE-2013-0195
    24Monitor

    Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    MediumCVSS 6.1No exploitEPSS 1%

    matomo · matomoNov 20, 2019

  • CVE-2013-0194
    24Monitor

    Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    MediumCVSS 6.1No exploitEPSS 1%

    matomo · matomoNov 20, 2019

  • CVE-2013-0193
    24Monitor

    Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    MediumCVSS 6.1No exploitEPSS 1%

    matomo · matomoNov 20, 2019

  • CVE-2022-33156
    24Monitor

    The matomo_integration (aka Matomo Integration) extension before 1.3.2 for TYPO3 allows XSS.

    MediumCVSS 6.1No exploitEPSS 0%

    matomo · integrationJul 12, 2022

  • CVE-2023-6923
    24Monitor

    Matomo <= 4.15.3 - Reflected Cross-Site Scripting via idsite

    MediumCVSS 6.1No exploitEPSS 0%

    matomo · matomoFeb 28, 2024

  • CVE-2011-0401
    20Monitor

    Piwik before 1.1 does not properly limit the number of files stored under tmp/sessions/, which might allow remote attackers to cause a denia

    MediumCVSS 5.0No exploitEPSS 1%

    matomo · matomoJan 10, 2011

  • CVE-2011-0400
    20Monitor

    Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote att

    MediumCVSS 5.0No exploitEPSS 1%

    matomo · matomoJan 10, 2011

  • CVE-2011-3791
    20Monitor

    Piwik 1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path i

    MediumCVSS 5.0No exploitEPSS 1%

    matomo · matomoSep 23, 2011

  • CVE-2009-1085
    20Monitor

    Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to

    MediumCVSS 5.0No exploitEPSS 1%

    matomo · matomoMar 25, 2009

  • CVE-2013-2633
    20Monitor

    Piwik before 1.11 accepts input from a POST request instead of a GET request in unspecified circumstances, which might allow attackers to ob

    MediumCVSS 5.0No exploitEPSS 0%

    matomo · matomoMar 21, 2013

  • CVE-2025-4415
    19Monitor

    Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058

    MediumCVSS 4.8No exploitEPSS 0%

    matomo · piwik proMay 21, 2025

  • CVE-2010-1453
    18Monitor

    Cross-site scripting (XSS) vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web scri

    MediumCVSS 4.3Proof of conceptEPSS 2%

    piwik · piwikMay 7, 2010

  • CVE-2011-0004
    17Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in Piwik before 1.1 allow remote attackers to inject arbitrary web script or HTML via un

    MediumCVSS 4.3No exploitEPSS 1%

    matomo · matomoJan 10, 2011

  • CVE-2011-0399
    17Monitor

    Piwik before 1.1 does not prevent the rendering of the login form inside a frame in a third-party HTML document, which makes it easier for r

    MediumCVSS 4.3No exploitEPSS 1%

    matomo · matomoJan 10, 2011

  • CVE-2019-12215
    17Monitor

    A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path o

    MediumCVSS 4.3No exploitEPSS 1%

    matomo · matomoMay 20, 2019

  • CVE-2012-4541
    17Monitor

    Cross-site scripting (XSS) vulnerability in Piwik before 1.9 allows remote attackers to inject arbitrary web script or HTML via unspecified

    MediumCVSS 4.3No exploitEPSS 1%

    matomo · matomoNov 19, 2012

  • CVE-2013-1844
    17Monitor

    Cross-site scripting (XSS) vulnerability in Piwik before 1.11 allows remote attackers to inject arbitrary web script or HTML via unspecified

    MediumCVSS 4.3No exploitEPSS 0%

    matomo · matomoMar 21, 2013