CVE-2016-5097

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.49%

Published

Jul 4, 2016

Modified

May 6, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs.

Weaknesses (CWE)

CWE-200

Affected Products (2)

opensuse · opensusevulnerable

phpmyadmin · phpmyadminvulnerable

References (16)

http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html

http://www.securitytracker.com/id/1035978

https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578f

Patch

https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1

Patch

https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0f

Patch

https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3

Patch

https://security.gentoo.org/glsa/201701-32

https://www.phpmyadmin.net/security/PMASA-2016-14

PatchVendor Advisory

http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html

http://www.securitytracker.com/id/1035978

https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578f

Patch

https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1

Patch

https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0f

Patch

https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3

Patch

https://security.gentoo.org/glsa/201701-32

https://www.phpmyadmin.net/security/PMASA-2016-14

PatchVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs