Piwik (now Matomo)

Records1All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Piwik (now Matomo) records in CISA KEV

No Piwik (now Matomo) vulnerabilities are listed in CISA KEV.

1 record

TI-2025-24264 CVE-2025-34104 · GHSA-7p5r-mwrp-qhhq

MEDIUM 46

An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.01906 Published 2025-07-15 Fixed in 3.0.3 CWE-306