CVE-2016-4412
An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to...
CVE-2016-4412 is a medium vulnerability (CVSS 4.4) in Phpmyadmin, published December 11, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.02%, the 64th percentile. Fixed in phpmyadmin 4:4.1.7-1.
- Severity
- 4.4 MediumCVSS 3.0, NVD
- Exploit chance
- 1.02%EPSS, 64th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4:4.1.7-1phpmyadmin +4 more
Description
An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadminDebian:12 | before 4:4.1.7-1 | 4:4.1.7-1 |
phpmyadminDebian:13 | before 4:4.1.7-1 | 4:4.1.7-1 |
phpmyadminDebian:14 | before 4:4.1.7-1 | 4:4.1.7-1 |
phpmyadminDebian:7 From an advisory covering 7 CVEs | before 4:3.4.11.1-2+deb7u7, plus listed versions 4:3.4.11.1-24:3.4.11.1-2+deb7u14:3.4.11.1-2+deb7u24:3.4.11.1-2+deb7u34:3.4.11.1-2+deb7u44:3.4.11.1-2+deb7u54:3.4.11.1-2+deb7u6 | 4:3.4.11.1-2+deb7u7 |
phpmyadminUbuntu:Pro:14.04:LTS | All versions, plus listed versions 4:4.0.6-14:4.0.8-14:4.0.9-14:4.0.10-14:4.0.10-1ubuntu0.1 Show 4 moreShow less4:4.0.10-1ubuntu0.1+esm14:4.0.10-1ubuntu0.1+esm24:4.0.10-1ubuntu0.1+esm34:4.0.10-1ubuntu0.1+esm4 | None known |
What each source reports
NVD Score used
An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected.
- Record
CVE-2016-4412- CVSS 3.0
- 4.4 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.6 Low
AV:N/AC:H/Au:S/C:P/I:P/A:N - Weakness
- CWE-254
- Updated
- 2026-11-02
CVE ListNo score
An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected.
- Record
CVE-2016-4412- Updated
- 2026-11-02
EUVDEUVD-2016-5412No score
An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected.
- Record
EUVD-2016-5412- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r57r-r9wp-wc2v
An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to...
An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected.
- Record
GHSA-r57r-r9wp-wc2v- CVSS 3.0
- 4.4 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSV
An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected.
- Record
CVE-2016-4412- CVSS 3.0
- 4.4 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-4412
An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected.
- Record
DEBIAN-CVE-2016-4412- CVSS 3.0
- 4.4 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-4412
An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected.
- Record
UBUNTU-CVE-2016-4412- CVSS 3.0
- 4.4 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.