GitHub Advisoryadvisory · Packagist

GHSA-rh74-5835-jpxp phpMyAdmin vulnerable to Cross-site Scripting

MEDIUM Published 2022-05-14 Modified 2025-04-14 Official page ↗
Aliases
CVE-2016-5701
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-74
Reviewed
2025-04-14

Affected packages

• Packagist phpmyadmin/phpmyadmin: >= 4.0.10.0, < 4.0.10.16 → fixed in 4.0.10.16 • Packagist phpmyadmin/phpmyadmin: >= 4.4.15.0, < 4.4.15.7 → fixed in 4.4.15.7 • Packagist phpmyadmin/phpmyadmin: >= 4.6.0, < 4.6.3 → fixed in 4.6.3

Description

setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to conduct BBCode injection attacks against HTTP sessions via a crafted URI.

Related

Alias · CVE (1)

  • CVE-2016-5701 setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References