Servers and applications
CVE-2016-5097
phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs.
- Severity
- Medium 5.3
- Published
- 5 Jul 2016
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 1.5% in the next 30 daysHigher than 74% of CVEs. EPSS by FIRST, 11 Nov 2026
- Weakness
- Information exposure (CWE-200)
- Attack
- Over the network · No login needed · No user action needed
- Attacker can
- Read some data
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
phpMyAdminServers and applications · cpe:a:phpmyadmin:phpmyadmin |
|