CVE-2016-5097

phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs.

• CWE-200

• http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html
• http://www.securitytracker.com/id/1035978
• https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578fPatch
• https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1Patch
• https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0fPatch
• https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3Patch
• https://security.gentoo.org/glsa/201701-32
• https://www.phpmyadmin.net/security/PMASA-2016-14Patch, Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html
• http://www.securitytracker.com/id/1035978
• https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578fPatch
• https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1Patch
• https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0fPatch
• https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3Patch
• https://security.gentoo.org/glsa/201701-32
• https://www.phpmyadmin.net/security/PMASA-2016-14Patch, Vendor Advisory

Published

Jul 5, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-5091Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and …
• CVE-2016-5092Directory traversal vulnerability in Fortinet FortiWeb befor…
• CVE-2016-5093The get_icu_value_internal function in ext/intl/locale/local…
• CVE-2016-5094Integer overflow in the php_html_entities function in ext/st…
• CVE-2016-5095Integer overflow in the php_escape_html_entities_ex function…
• CVE-2016-5096Integer overflow in the fread function in ext/standard/file.…
• CVE-2016-5098Directory traversal vulnerability in libraries/error_report.…
• CVE-2016-5099Cross-site scripting (XSS) vulnerability in phpMyAdmin 4.4.x…
• CVE-2016-5100Froxlor before 0.9.35 uses the PHP rand function for random …
• CVE-2016-5101Unspecified vulnerability in Opera Mail before 2016-02-16 on…
• CVE-2016-5102Buffer overflow in the readgifimage function in gif2tiff.c i…
• CVE-2016-5103Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…