CVE-2016-6617

An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used...

8.1 HighFix available

CVE-2016-6617 is a high vulnerability (CVSS 8.1) in Phpmyadmin, published December 11, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile. Fixed in phpmyadmin 4.4.15.8-r0.

An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions (prior to 4.6.4) are affected.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.51%Up 0.6 points since Feb 4, 2022

What each source reports

NVD Score used 8.1

Record: CVE-2016-6617
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-89
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-6617
Updated: 2026-11-02

EUVDEUVD-2016-7531 No score

Record: EUVD-2016-7531
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w93p-25g8-q8w9 8.1

An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used...

Record: GHSA-w93p-25g8-q8w9
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

OSVALPINE-CVE-2016-6617 8.1

Record: ALPINE-CVE-2016-6617
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 8.1

Record: CVE-2016-6617
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-6617 8.1

Record: DEBIAN-CVE-2016-6617
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10054-1 No score

phpMyAdmin-4.6.5.2-1.1 on GA media

These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10054-1
Updated: 2026-11-02

Affected products

phpmyadmin

Affected packages

Affected packages
Package	Affected	Fixed
`phpmyadmin` Alpine:v3.2	before 4.4.15.8-r0	4.4.15.8-r0
`phpmyadmin` Debian:12	before 4:4.6.4+dfsg1-1	4:4.6.4+dfsg1-1
`phpmyadmin` Debian:13	before 4:4.6.4+dfsg1-1	4:4.6.4+dfsg1-1
`phpmyadmin` Debian:14	before 4:4.6.4+dfsg1-1	4:4.6.4+dfsg1-1
`phpMyAdmin` openSUSE:Tumbleweed	before 4.6.5.2-1.1	4.6.5.2-1.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 125 moreShow less