CVE-2016-6608
phpMyAdmin Cross-site Scripting (XSS)
CVE-2016-6608 is a medium vulnerability (CVSS 6.1) in Phpmyadmin, published December 11, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.28%, the 70th percentile. Fixed in phpmyadmin/phpmyadmin 4.6.4.
XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.
- Record
CVE-2016-6608- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.
- Record
CVE-2016-6608- Updated
- 2026-11-02
EUVDEUVD-2022-4349 No score
XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.
- Record
EUVD-2022-4349- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jfmj-27fp-qp67
phpMyAdmin Cross-site Scripting (XSS)
XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.
- Record
GHSA-jfmj-27fp-qp67- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVALPINE-CVE-2016-6608
XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.
- Record
ALPINE-CVE-2016-6608- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSV
XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.
- Record
CVE-2016-6608- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-6608
XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.
- Record
DEBIAN-CVE-2016-6608- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-jfmj-27fp-qp67
phpMyAdmin Cross-site Scripting (XSS)
XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.
- Record
GHSA-jfmj-27fp-qp67- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10054-1 No score
phpMyAdmin-4.6.5.2-1.1 on GA media
These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10054-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadmin/phpmyadminPackagist |
4.6 up to 4.6.4 | 4.6.4 |
phpmyadminAlpine:v3.2 |
before 4.4.15.8-r0 | 4.4.15.8-r0 |
phpmyadminDebian:12 |
before 4:4.6.4+dfsg1-1 | 4:4.6.4+dfsg1-1 |
phpmyadminDebian:13 |
before 4:4.6.4+dfsg1-1 | 4:4.6.4+dfsg1-1 |
phpmyadminDebian:14 |
before 4:4.6.4+dfsg1-1 | 4:4.6.4+dfsg1-1 |
phpMyAdminopenSUSE:Tumbleweed |
before 4.6.5.2-1.1 | 4.6.5.2-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
phpmyadmin.net/security/PMASA-2016-31
securityfocus.com/bid/93258
security.gentoo.org/glsa/201701-32
nvd.nist.gov/vuln/detail/CVE-2016-6608
github.com/advisories/GHSA-jfmj-27fp-qp67
security.alpinelinux.org/vuln/CVE-2016-6608
Show 126 moreShow less
security-tracker.debian.org/tracker/CVE-2016-6608
suse.com/security/cve/CVE-2011-4107