Medium severity · published May 12, 2017
CVE-2016-4855
Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
6.1
CVSS
1.9%
EPSS
No
On KEV
Description
Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Adodb · Adodb Project
through 5.20.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-4855
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-4855
Third Party Advisory
http://jvn.jp/en/jp/JVN48237713/index.html
Third Party Advisory
http://www.securityfocus.com/bid/92753
Third Party Advisory
https://github.com/ADOdb/ADOdb/issues/274
security.gentoo.org
https://security.gentoo.org/glsa/201701-59
More from Adodb
9.8
CVE-2016-7405
The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to…
9.1
CVE-2021-3850
Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21