{"id":"CVE-2016-5702","details":"phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI.","aliases":["GHSA-xqw9-ffx7-g998"],"modified":"2026-07-08T12:53:14.671888Z","published":"2016-07-03T01:59:13.407Z","related":["openSUSE-SU-2024:10054-1"],"references":[{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201701-32"},{"type":"FIX","url":"https://github.com/phpmyadmin/phpmyadmin/commit/27caf5b46bd0890e576fea7bd7b166a0639fdf68"},{"type":"FIX","url":"https://www.phpmyadmin.net/security/PMASA-2016-18/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/phpmyadmin/phpmyadmin","events":[{"introduced":"37b38431d167915675fc8ab512470528147e72de"},{"last_affected":"35e191d74b50c8f5a7b87fa9889869cc3a88255d"},{"fixed":"27caf5b46bd0890e576fea7bd7b166a0639fdf68"}],"database_specific":{"cpe":["cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*","cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*","cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*","cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*","cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*","cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.6.0"},{"last_affected":"4.6.0"},{"introduced":"4.6.0-alpha1"},{"last_affected":"4.6.0-alpha1"},{"introduced":"4.6.0-rc1"},{"last_affected":"4.6.0-rc1"},{"introduced":"4.6.0-rc2"},{"last_affected":"4.6.0-rc2"},{"introduced":"4.6.1"},{"last_affected":"4.6.1"},{"introduced":"4.6.2"},{"last_affected":"4.6.2"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["4.6.0","4.6.0-alpha1","4.6.0-rc1","4.6.0-rc2","4.6.1","4.6.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5702.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}