{"id":"GHSA-7rf8-9r8f-qf59","summary":"phpMyAdmin Cross-site scripting (XSS) vulnerability in SQL parser","details":"Cross-site scripting (XSS) vulnerability in the format function in libraries/sql-parser/src/Utils/Error.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query.","aliases":["CVE-2016-2559"],"modified":"2024-04-24T17:42:00.052318Z","published":"2022-05-17T03:31:15Z","database_specific":{"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-04-24T17:21:07Z","nvd_published_at":"2016-03-01T11:59:00Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2559"},{"type":"WEB","url":"https://github.com/phpmyadmin/phpmyadmin/commit/3a6a9a807d99371ee126635e1a505fc1fe0df32c"},{"type":"PACKAGE","url":"https://github.com/phpmyadmin/composer"},{"type":"WEB","url":"https://www.phpmyadmin.net/security/PMASA-2016-10"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"}],"affected":[{"package":{"name":"phpmyadmin/phpmyadmin","ecosystem":"Packagist","purl":"pkg:composer/phpmyadmin/phpmyadmin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5"},{"fixed":"4.5.5.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-7rf8-9r8f-qf59/GHSA-7rf8-9r8f-qf59.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}