The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize function, which allows remote attackers to execute arbitrary code or upload arbitrary files via vectors related to the destruct function in the PiwikConfig class; php://filter URIs; the destruct functions in Zend Framework, as demonstrated by the ZendLog destructor; the shutdown functions in Zend Framework, as demonstrated by the ZendLogWriterMail class; the render function in the PiwikView class; Smarty templates; and the eval function in Smarty.

Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh.

Cross-site scripting (XSS) vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the formurl parameter.