cbcvebase.
CVE-2016-9856
published 2016-12-11

CVE-2016-9856: An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to…

PriorityP427medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
1.47%
70.8th percentile
An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

Affected

71 ranges· showing 25
VendorProductVersion rangeFixed in
debianphpmyadmin< phpmyadmin 4:4.6.5.1-1 (bookworm)phpmyadmin 4:4.6.5.1-1 (bookworm)
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——
phpmyadminphpmyadmin——

CVSS provenance

nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
ghsa5.4MEDIUM
osv5.4MEDIUM
vendor_debian5.4LOW
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.