CVE-2026-71285

Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo siteId value as a bare, unquoted JavaScript expression inside a block rendered on every public status page: paq.push'setSiteId', $escapedSiteIdHTMLAttribute;. The escaping pipelin...

EUVD-2026-53370

Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo siteId value as a bare, unquoted JavaScript expression inside a block rendered on every public status page: paq.push'setSiteId', $escapedSiteIdHTMLAttribute;. The escaping pipelin...

CVE-2026-71285

Uptime Kuma’s Matomo analytics integration (server/analytics/matomo-analytics.js) is affected. The admin-configurable Matomo siteId is injected as a bare, unquoted JavaScript expression inside a [removed] block on every public status page: _paq.push(['setSiteId', ${escapedSiteIdHTMLAttribute}]);....

CVE-2026-71285 Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages

Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo siteId value as a bare, unquoted JavaScript expression inside a block rendered on every public status page: paq.push'setSiteId', $escapedSiteIdHTMLAttribute;. The escaping pipelin...

CVE-2026-71285 Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages

Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo siteId value as a bare, unquoted JavaScript expression inside a block rendered on every public status page: paq.push'setSiteId', $escapedSiteIdHTMLAttribute;. The escaping pipelin...

CVE-2023-4774

The WP-Matomo Integration WP-Piwik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp-piwik' shortcode in versions up to, and including, 1.0.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

EUVD-2013-1851

Malware in sbrugna...

EUVD-2011-4851

Malware in sbrugna...

EUVD-2023-59122

Malicious code in bioql PyPI...

EUVD-2024-37077

Malicious code in bioql PyPI...

EUVD-2023-27746

Malicious code in bioql PyPI...

EUVD-2025-9037

Malicious code in bioql PyPI...

EUVD-2025-26540

Malicious code in bioql PyPI...

EUVD-2023-54620

Malicious code in bioql PyPI...

EUVD-2022-6056

Malicious code in bioql PyPI...

EUVD-2023-37381

Malicious code in bioql PyPI...

CVE-2025-58630

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rbaer Simple Matomo Tracking Code simple-matomo-tracking-code allows Stored XSS.This issue affects Simple Matomo Tracking Code: from n/a through = 1.1.0...

CVE-2025-58630

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rbaer Simple Matomo Tracking Code simple-matomo-tracking-code allows Stored XSS.This issue affects Simple Matomo Tracking Code: from n/a through = 1.1.0...

WordPress Simple Matomo Tracking Code Plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Que Thanh Tuan - Blue Rock in WordPress Plugin Simple Matomo Tracking Code versions = 1.1.0...

CVE-2025-58630 WordPress Simple Matomo Tracking Code Plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rbaer Simple Matomo Tracking Code simple-matomo-tracking-code allows Stored XSS.This issue affects Simple Matomo Tracking Code: from n/a through = 1.1.0...