{"id":"CVE-2016-9866","url":"https://www.cyber-defence.io/tools/cve/CVE-2016-9866","generatedAt":"2026-10-28T21:55:12.745Z","title":"When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action.","description":"An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.","published":"2016-12-11T03:00:09.000Z","lastModified":"2026-06-17T00:56:42.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-352"],"affected":["phpmyadmin/phpmyadmin"],"epss":{"score":0.01027,"percentile":0.63461,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (1.03%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"http://www.securityfocus.com/bid/94536","source":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/201701-32","source":"cve@mitre.org"},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-71","tags":["Patch","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/94536","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201701-32","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-71","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-9866","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}