Vulnerability Database

315,050

Total vulnerabilities in the database

CVE-2016-5702

phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI.

Published: Jul 3, 2016
Updated: Nov 9, 2025
CVE: CVE-2016-5702
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

CWE-254

Affected Software
References

Software	From	Fixed in
phpmyadmin / phpmyadmin	4.6.1	4.6.1.x
phpmyadmin / phpmyadmin	4.6.0-rc2	4.6.0-rc2.x
phpmyadmin / phpmyadmin	4.6.0	4.6.0.x
phpmyadmin / phpmyadmin	4.6.2	4.6.2.x
phpmyadmin / phpmyadmin	4.6.0-rc1	4.6.0-rc1.x
phpmyadmin / phpmyadmin	4.6.0-alpha1	4.6.0-alpha1.x

https://github.com/phpmyadmin/phpmyadmin/commit/27caf5b46bd0890e576fea7bd7b166a0639fdf68
https://security.gentoo.org/glsa/201701-32
https://www.phpmyadmin.net/security/PMASA-2016-18/

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo