148 matches found
CVE-2026-78850
Matomo 认证 SiteContentDetector 盲 SSRF 报告者 姓名： CYBER-SEC 联系方式： [email protected] 摘要 Matomo 允许经过认证的站点管理员将站点的 mainurl 配置为内部地址。任何具有查看权限的认证用户之后都可以触发 getTrackingMethodsForSite，导致服务器向配置的 URL 发起盲 HTTP 请求。 目标地址仅通过基于主机名的防护进行验证，并且在解析后未能正确拒绝环回地址、RFC1918 地址或链路本地地址。因此，该应用程序可能被滥用，以对内部服务执行盲服务器端请求。 受影响产品 产品：...
CVE-2026-79989
The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission which doesn’t allow changing...
CVE-2026-71285
Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary...
EUVD-2026-53370
Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo siteId value as a bare, unquoted JavaScript expression inside a block rendered on every public status page: paq.push'setSiteId', $escapedSiteIdHTMLAttribute;. The escaping pipelin...
CVE-2026-71285
Uptime Kuma’s Matomo analytics integration (server/analytics/matomo-analytics.js) is affected. The admin-configurable Matomo siteId is injected as a bare, unquoted JavaScript expression inside a [removed] block on every public status page: _paq.push(['setSiteId', ${escapedSiteIdHTMLAttribute}]);....
CVE-2026-71285
Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a...
CVE-2026-71285 Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages
Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary...
CVE-2026-71285 Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages
Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary...
CVE-2026-71285 Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages
Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary...
CVE-2023-4774
The WP-Matomo Integration WP-Piwik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp-piwik' shortcode in versions up to, and including, 1.0.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...
EUVD-2013-1851
Malware in sbrugna...
EUVD-2011-4851
Malware in sbrugna...
EUVD-2023-59122
Malicious code in bioql PyPI...
EUVD-2024-37077
Malicious code in bioql PyPI...
EUVD-2023-27746
Malicious code in bioql PyPI...
EUVD-2025-26540
Malicious code in bioql PyPI...
EUVD-2025-9037
Malicious code in bioql PyPI...
EUVD-2023-37381
Malicious code in bioql PyPI...