Description

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.

Remediation

References

CVE-2016-5730

Related Vulnerabilities

Joomla! Core 3.9.x Cross-Site Scripting (3.9.0 - 3.9.20)

Werkzeug WSGI Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-10516)

WordPress Plugin WP-RecentComments 'page' Parameter Cross-Site Scripting (2.0.6)

WordPress Plugin Simple Sitemap-Create a Responsive HTML Sitemap Unspecified Vulnerability (1.53)

WordPress Plugin WP Photo Album Plus Unspecified Vulnerability (7.2.04)

Severity

Medium

Classification

CVE-2016-5730 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities