CVE-2016-9862

An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject...

7.5 HighFix available

CVE-2016-9862 is a high vulnerability (CVSS 7.5) in Phpmyadmin, published December 11, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.57%, the 75th percentile. Fixed in phpmyadmin 4.6.5.2-r0.

An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

1.57%Up 0.6 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected.

Record: CVE-2016-9862
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-94
Updated: 2026-11-02

CVE List No score

An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected.

Record: CVE-2016-9862
Updated: 2026-11-02

EUVDEUVD-2016-10655 No score

An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected.

Record: EUVD-2016-10655
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c9vh-vmq6-qhgr 7.5

An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject...

An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected.

Record: GHSA-c9vh-vmq6-qhgr
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-94
Updated: 2026-11-02

OSVALPINE-CVE-2016-9862 7.5

An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected.

Record: ALPINE-CVE-2016-9862
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSV 7.5

An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected.

Record: CVE-2016-9862
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-9862 7.5

An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected.

Record: DEBIAN-CVE-2016-9862
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-9862 7.5

An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected.

Record: UBUNTU-CVE-2016-9862
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10054-1 No score

phpMyAdmin-4.6.5.2-1.1 on GA media

These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10054-1
Updated: 2026-11-02

Affected products

phpmyadmin

Affected packages

Affected packages
Package	Affected	Fixed
`phpmyadmin` Alpine:v3.4	before 4.6.5.2-r0	4.6.5.2-r0
`phpmyadmin` Debian:12	before 4:4.6.5.1-1	4:4.6.5.1-1
`phpmyadmin` Debian:13	before 4:4.6.5.1-1	4:4.6.5.1-1
`phpmyadmin` Debian:14	before 4:4.6.5.1-1	4:4.6.5.1-1
`phpMyAdmin` openSUSE:Tumbleweed	before 4.6.5.2-1.1	4.6.5.2-1.1

History

History
When	Changed	Sources
2026-11-03	affected
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 127 moreShow less