CVE-2016-9856

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Dec 11, 2016
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-98576.1An issue was discovered in phpMyAdmin. XSS is possible because of a weakness in a regular expression used in some JavaScript processing. AllCVE-2016-98585.3An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in savedCVE-2016-98595.3An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in imporCVE-2016-98605.9An issue was discovered in phpMyAdmin. An unauthenticated user can execute a denial of service attack when phpMyAdmin is running with $cfg['CVE-2016-98617.5An issue was discovered in phpMyAdmin. Due to the limitation in URL matching, it was possible to bypass the URL white-list protection. All 4CVE-2016-98627.5An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (pCVE-2016-98637.5An issue was discovered in phpMyAdmin. With a very large request to table partitioning function, it is possible to invoke a Denial of ServicCVE-2016-98647.5An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking funCVE-2016-98659.8An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMA_saCVE-2016-98669.8An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly strippeCVE-2016-98678.8An issue was discovered in EMC ScaleIO versions before 2.0.1.1. A low-privileged local attacker may be able to modify the kernel memory in tCVE-2016-98685.5An issue was discovered in EMC ScaleIO versions before 2.0.1.1. A low-privileged local attacker may cause a denial-of-service by generating
CVE-2016-9856: Medium severity, CVSS 6.1 | Vulnix