Piwik versions 2.14.3 and below suffer from a PHP object injection vulnerability that can lead to remote code execution.