146 matches found
CVE-2026-71285
Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary...
EUVD-2026-53370
Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo siteId value as a bare, unquoted JavaScript expression inside a block rendered on every public status page: paq.push'setSiteId', $escapedSiteIdHTMLAttribute;. The escaping pipelin...
CVE-2026-71285 Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages
Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary...
CVE-2026-71285
Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a...
CVE-2026-71285
Uptime Kuma’s Matomo analytics integration (server/analytics/matomo-analytics.js) is affected. The admin-configurable Matomo siteId is injected as a bare, unquoted JavaScript expression inside a [removed] block on every public status page: _paq.push(['setSiteId', ${escapedSiteIdHTMLAttribute}]);....
CVE-2026-71285 Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages
Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary...
CVE-2026-71285 Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages
Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary...
CVE-2023-4774
The WP-Matomo Integration WP-Piwik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp-piwik' shortcode in versions up to, and including, 1.0.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...
EUVD-2013-1851
Malware in sbrugna...
EUVD-2011-4851
Malware in sbrugna...
EUVD-2023-27746
Malicious code in bioql PyPI...
EUVD-2024-37077
Malicious code in bioql PyPI...
EUVD-2023-59122
Malicious code in bioql PyPI...
EUVD-2025-9037
Malicious code in bioql PyPI...
EUVD-2025-26540
Malicious code in bioql PyPI...
EUVD-2023-37381
Malicious code in bioql PyPI...
EUVD-2022-6056
Malicious code in bioql PyPI...
EUVD-2023-54620
Malicious code in bioql PyPI...
CVE-2025-58630
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rbaer Simple Matomo Tracking Code simple-matomo-tracking-code allows Stored XSS.This issue affects Simple Matomo Tracking Code: from n/a through = 1.1.0...
CVE-2025-58630
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rbaer Simple Matomo Tracking Code simple-matomo-tracking-code allows Stored XSS.This issue affects Simple Matomo Tracking Code: from n/a through = 1.1.0...