Search for vulnerabilities
Vulnerability details: VCID-v3xe-8zk4-q3gm
Vulnerability ID VCID-v3xe-8zk4-q3gm
Aliases CVE-2016-5702
GHSA-xqw9-ffx7-g998
Summary phpMyAdmin cookie-attribute injection phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI.
Status Published
Exploitability 0.5
Weighted Severity 3.3
Risk 1.6
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-254 7PK - Security Features
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
epss 0.00399 https://api.first.org/data/v1/epss?cve=CVE-2016-5702
cvssv3.1_qr LOW https://github.com/advisories/GHSA-xqw9-ffx7-g998
cvssv3.1 3.7 https://github.com/phpmyadmin/phpmyadmin
generic_textual LOW https://github.com/phpmyadmin/phpmyadmin
cvssv3.1 3.7 https://github.com/phpmyadmin/phpmyadmin/commit/27caf5b46bd0890e576fea7bd7b166a0639fdf68
generic_textual LOW https://github.com/phpmyadmin/phpmyadmin/commit/27caf5b46bd0890e576fea7bd7b166a0639fdf68
cvssv3.1 3.7 https://nvd.nist.gov/vuln/detail/CVE-2016-5702
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2016-5702
cvssv3.1 3.7 https://security.gentoo.org/glsa/201701-32
generic_textual LOW https://security.gentoo.org/glsa/201701-32
cvssv3.1 3.7 https://www.phpmyadmin.net/security/PMASA-2016-18
generic_textual LOW https://www.phpmyadmin.net/security/PMASA-2016-18
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2016-5702
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5702
https://github.com/phpmyadmin/phpmyadmin
https://github.com/phpmyadmin/phpmyadmin/commit/27caf5b46bd0890e576fea7bd7b166a0639fdf68
https://nvd.nist.gov/vuln/detail/CVE-2016-5702
https://security.gentoo.org/glsa/201701-32
https://www.phpmyadmin.net/security/PMASA-2016-18
https://www.phpmyadmin.net/security/PMASA-2016-18/
GHSA-xqw9-ffx7-g998 https://github.com/advisories/GHSA-xqw9-ffx7-g998
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/phpmyadmin/phpmyadmin
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/phpmyadmin/phpmyadmin/commit/27caf5b46bd0890e576fea7bd7b166a0639fdf68
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2016-5702
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://security.gentoo.org/glsa/201701-32
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://www.phpmyadmin.net/security/PMASA-2016-18
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.49828
EPSS Score 0.00266
Published At Sept. 9, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T09:08:36.241343+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xqw9-ffx7-g998/GHSA-xqw9-ffx7-g998.json 37.0.0