Servers and applications
CVE-2016-5701 setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to conduct BBCode injection attacks against HTTP sessions via a crafted URI.
Severity Medium 6.1
Published 3 Jul 2016
Last changed 17 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 1.5% in the next 30 daysHigher than 75% of CVEs. EPSS by FIRST , 11 Nov 2026
Attack Over the network · No login needed · Needs someone to click or open something
Attacker can Read some data · Change some data
CVSS vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Sources NVD Affected software Software Affected versions phpMyAdminServers and applications · cpe:a:phpmyadmin:phpmyadmin Version 4.6.2 Version 4.6.1 Version 4.6.0 Version 4.6.0-rc2 All 59 release lines Version 4.0.0 Version 4.0.1 Version 4.0.2 Version 4.0.3 Version 4.0.4 Version 4.0.4.1 Version 4.0.4.2 Version 4.0.5 Version 4.0.6 Version 4.0.7 Version 4.0.8 Version 4.0.9 Version 4.0.10 Version 4.0.10.1 Version 4.0.10.2 Version 4.0.10.3 Version 4.0.10.4 Version 4.0.10.5 Version 4.0.10.6 Version 4.0.10.7 Version 4.0.10.8 Version 4.0.10.9 Version 4.0.10.10 Version 4.0.10.11 Version 4.0.10.12 Version 4.0.10.13 Version 4.0.10.14 Version 4.0.10.15 Version 4.4.0 Version 4.4.1 Version 4.4.1.1 Version 4.4.2 Version 4.4.3 Version 4.4.4 Version 4.4.5 Version 4.4.6 Version 4.4.6.1 Version 4.4.7 Version 4.4.8 Version 4.4.9 Version 4.4.10 Version 4.4.11 Version 4.4.12 Version 4.4.13 Version 4.4.13.1 Version 4.4.14.1 Version 4.4.15 Version 4.4.15.1 Version 4.4.15.2 Version 4.4.15.3 Version 4.4.15.4 Version 4.4.15.5 Version 4.4.15.6 Version 4.6.0-alpha1 Version 4.6.0-rc1 Version 4.6.0-rc2 Version 4.6.0 Version 4.6.1 Version 4.6.2
References NVD https://nvd.nist.gov/vuln/detail/CVE-2016-5701 CVE.org https://www.cve.org/CVERecord?id=CVE-2016-5701