GitHub Advisoryadvisory · Packagist

GHSA-5fpj-6vq6-fmwh Piwik (now Matomo) Vulnerable to Cross-Site Scripting (XSS)

LOW Published 2022-05-13 Modified 2025-04-12 Official page ↗

Aliases: CVE-2013-1844
Ecosystem: Packagist
Packages: matomo/matomo, piwik/piwik
Severity: Low
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
Weaknesses: CWE-79
Reviewed: 2025-04-12

Affected packages

• Packagist matomo/matomo: < 1.11 → fixed in 1.11 • Packagist piwik/piwik: < 1.11 → fixed in 1.11

Description

Cross-site scripting (XSS) vulnerability in Piwik before 1.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Related

Alias · CVE (1)

CVE-2013-1844 Cross-site scripting (XSS) vulnerability in Piwik before 1.11 allows remote attackers to inject arbitrary web script or HTML via… vulnerability

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References