{"id":"CVE-2016-4855","aliases":["DEBIAN-CVE-2016-4855","DLA-620-1","EUVD-2022-4154","GHSA-hhfw-xxhm-pf32","MGASA-2016-0363","UBUNTU-CVE-2016-4855","USN-6825-1"],"status":"published","title":"ADOdb Cross-site scripting vulnerability in old test script","description":"Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01946,"percentile":0.80323,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2016-09-13T00:00:00Z","modified":"2026-10-20T10:47:53Z","fixes":[{"ecosystem":"Packagist","package":"adodb/adodb-php","fixed_in":["5.20.6"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libphp-adodb","fixed_in":["5.20.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libphp-adodb","fixed_in":["5.20.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libphp-adodb","fixed_in":["5.20.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libphp-adodb","fixed_in":["5.15-1+deb7u1build0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libphp-adodb","fixed_in":["5.20.3-1ubuntu1+esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"adodb/adodb-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.6-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15-1+deb7u1"}]}],"versions":["5.15-1"],"bundled":2},{"source":"osv","ecosystem":"Packagist","package":"adodb/adodb-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.6"}]}],"versions":["v5.19","v5.20.0","v5.20.1","v5.20.2","v5.20.3","v5.20.4","v5.20.5"]},{"source":"osv","ecosystem":"Mageia:5","package":"php-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18-5.1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15-1+deb7u1build0.14.04.1"}]}],"versions":["5.15-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.3-1ubuntu1+esm1"}]}],"versions":["5.18a-1","5.20.1-1","5.20.2-1","5.20.2-2","5.20.3-1","5.20.3-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.3-1ubuntu1+esm1"}]}],"versions":["5.18a-1","5.20.1-1","5.20.2-1","5.20.2-2","5.20.3-1","5.20.3-1ubuntu1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.9-1ubuntu0.1~esm1"}]}],"versions":["5.20.9-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.16-1ubuntu0.1~esm1"}]}],"versions":["5.20.14-1","5.20.15-1","5.20.16-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libphp-adodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.19-1ubuntu0.1"}]}],"versions":["5.20.19-1"],"bundled":3}],"products":[{"vendor":"adodb","product":"adodb"},{"vendor":"adodb_project","product":"adodb"}],"references":[{"url":"https://github.com/ADOdb/ADOdb/issues/274","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/92753","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://security.gentoo.org/glsa/201701-59","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"http://jvn.jp/en/jp/JVN48237713/index.html","tags":["third-party-advisory","x_refsource_JVN","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4855","tags":["advisory"]},{"url":"https://github.com/ADOdb/ADOdb/commit/ecb93d8c1fd3bbde62aca9c3a13c32f077da2da8","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/adodb/adodb-php/CVE-2016-4855.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hhfw-xxhm-pf32"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-4855","tags":["advisory"]},{"url":"https://github.com/ADOdb/ADOdb","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2016-0363.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19307","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/09/15/1","tags":["web"]},{"url":"http://lwn.net/Alerts/700508/","tags":["web"]},{"url":"http://lwn.net/Vulnerabilities/701151/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-4855","tags":["report"]},{"url":"https://jvn.jp/en/jp/JVN48237713/","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4855","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6825-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-7405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3850","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-4855","description":"Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2017-05-12T18:00:00Z","modified":"2024-08-06T00:46:38.444Z","updated_at":"2026-11-02T14:33:35.149563Z"}],"euvd":[{"id":"EUVD-2022-4154","description":"Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2017-05-12T18:00:00Z","modified":"2024-08-06T00:46:38Z","updated_at":"2026-11-03T02:22:44.489595Z"}],"ghsa":[{"id":"GHSA-hhfw-xxhm-pf32","title":"ADOdb Cross-site scripting vulnerability in old test script","description":"Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2022-05-17T02:37:30Z","modified":"2024-02-05T10:37:00Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:35.293818Z"}],"nvd":[{"id":"CVE-2016-4855","description":"Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2017-05-12T18:29:00.28Z","modified":"2026-06-17T00:48:20.313Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:38.290327Z"}],"osv":[{"id":"CVE-2016-4855","description":"Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2017-05-12T18:29:00.28Z","modified":"2026-10-20T10:47:53.159889418Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-4855","description":"Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2017-05-12T18:29:00.28Z","modified":"2026-09-22T07:00:26.114812739Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"GHSA-hhfw-xxhm-pf32","title":"ADOdb Cross-site scripting vulnerability in old test script","description":"Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2022-05-17T02:37:30Z","modified":"2024-02-16T08:10:49.569413Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"UBUNTU-CVE-2016-4855","description":"Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2017-05-12T18:29:00Z","modified":"2026-02-04T03:08:32.370375Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DLA-620-1","title":"libphp-adodb - security update","status":"published","published":"2016-09-13T00:00:00Z","modified":"2026-03-09T02:09:23.22975Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2016-0363","title":"Updated php-adodb packages fix security vulnerabilities","description":"The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x \nbefore 5.20.7 might allow remote attackers to conduct SQL injection attacks \nvia vectors related to incorrect quoting. (CVE-2016-7405)\n\nCross Site Scripting vulnerability in test script (CVE-2016-4855)\n","status":"published","published":"2016-11-03T22:53:34Z","modified":"2026-04-16T06:25:28.352831076Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"USN-6825-1","title":"libphp-adodb vulnerabilities","description":"It was discovered that the PDO driver in ADOdb was incorrectly handling\nstring quotes. A remote attacker could possibly use this issue to \nperform SQL injection attacks. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2016-7405)\n\nIt was discovered that ADOdb was incorrectly handling GET parameters in \ntest.php. A remote attacker could possibly use this issue to execute \ncross-site scripting (XSS) attacks. This issue only affected Ubuntu \n16.04 LTS. (CVE-2016-4855)\n\nEmmet Leahy discovered that ADOdb was incorrectly handling string quotes\nin PostgreSQL connections. A remote attacker could possibly use this issue\nto bypass authentication. (CVE-2021-3850)\n","status":"published","published":"2024-06-10T20:41:56Z","modified":"2026-06-25T13:30:34.62610008Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}