{"api_version":"1","generated_at":"2026-07-23T07:40:22+00:00","cve":"CVE-2016-5097","urls":{"html":"https://cve.report/CVE-2016-5097","api":"https://cve.report/api/cve/CVE-2016-5097.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-5097","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-5097"},"summary":{"title":"CVE-2016-5097","description":"phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs.","state":"PUBLISHED","assigner":"mitre","published_at":"2016-07-05 01:59:05","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-200","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1","name":"https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Pass link to demo server through url.php · phpmyadmin/phpmyadmin@59e56bd · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3","name":"https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Pass links to external sites in changelog through url.php · phpmyadmin/phpmyadmin@8326aae · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0f","name":"https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0f","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Ensure links from setup go through url.php · phpmyadmin/phpmyadmin@5fc8020 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html","name":"http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"openSUSE-SU-2016:1556-1: moderate: Security update for phpMyAdmin","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://security.gentoo.org/glsa/201701-32","name":"https://security.gentoo.org/glsa/201701-32","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"phpMyAdmin: Multiple vulnerabilities (GLSA 201701-32) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1035978","name":"http://www.securitytracker.com/id/1035978","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"phpMyAdmin Flaw Lets Remote Users Obtain Potentially Sensitive SQL Query Parameters from URLs - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-14","name":"https://www.phpmyadmin.net/security/PMASA-2016-14","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"phpMyAdmin - Security - PMASA-2016-14","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578f","name":"https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578f","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Improve handling of logout · phpmyadmin/phpmyadmin@11eb574 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5097","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5097","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"5097","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"opensuse","cpe5":"opensuse","cpe6":"13.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"5097","vulnerable":"1","versionEndIncluding":"4.6.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"phpmyadmin","cpe5":"phpmyadmin","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2016-5097","qid":"710467","title":"Gentoo Linux Hypertext Preprocessor (PHP) MyAdmin Multiple Vulnerabilities (GLSA 201701-32)"}]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T00:53:47.995Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://www.phpmyadmin.net/security/PMASA-2016-14"},{"name":"openSUSE-SU-2016:1556","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"},{"name":"1035978","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1035978"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578f"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0f"},{"name":"GLSA-201701-32","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"],"url":"https://security.gentoo.org/glsa/201701-32"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2016-05-22T00:00:00.000Z","descriptions":[{"lang":"en","value":"phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-01T09:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3"},{"tags":["x_refsource_CONFIRM"],"url":"https://www.phpmyadmin.net/security/PMASA-2016-14"},{"name":"openSUSE-SU-2016:1556","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"},{"name":"1035978","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1035978"},{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1"},{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578f"},{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0f"},{"name":"GLSA-201701-32","tags":["vendor-advisory","x_refsource_GENTOO"],"url":"https://security.gentoo.org/glsa/201701-32"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2016-5097","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3","refsource":"CONFIRM","url":"https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3"},{"name":"https://www.phpmyadmin.net/security/PMASA-2016-14","refsource":"CONFIRM","url":"https://www.phpmyadmin.net/security/PMASA-2016-14"},{"name":"openSUSE-SU-2016:1556","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"},{"name":"1035978","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1035978"},{"name":"https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1","refsource":"CONFIRM","url":"https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1"},{"name":"https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578f","refsource":"CONFIRM","url":"https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578f"},{"name":"https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0f","refsource":"CONFIRM","url":"https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0f"},{"name":"GLSA-201701-32","refsource":"GENTOO","url":"https://security.gentoo.org/glsa/201701-32"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2016-5097","datePublished":"2016-07-05T01:00:00.000Z","dateReserved":"2016-05-26T00:00:00.000Z","dateUpdated":"2024-08-06T00:53:47.995Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2016-07-05 01:59:05","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-200","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*","matchCriteriaId":"A10BC294-9196-425F-9FB0-B1625465B47F"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*","versionEndIncluding":"4.6.1","matchCriteriaId":"243F912A-3C8F-4187-A259-427CAAB45F81"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"5097","Ordinal":"1","Title":"CVE-2016-5097","CVE":"CVE-2016-5097","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"5097","Ordinal":"1","NoteData":"phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs.","Type":"Description","Title":"CVE-2016-5097"},{"CveYear":"2016","CveId":"5097","Ordinal":"2","NoteData":"2016-07-04","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"5097","Ordinal":"3","NoteData":"2017-09-01","Type":"Other","Title":"Modified"}]}}}