VULNERABILITY INTELLIGENCE

CVE-2016-9866

CVSS score9.8 CRITICAL
EPSS probability1.02%
CISA KEVNot currently listed
Published2016-12-11
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

Weakness classification

  • CWE-352: Cross-Site Request Forgery (CSRF)

Primary references