{"id":"CVE-2016-1927","aliases":["DEBIAN-CVE-2016-1927","DLA-481-1","DSA-3627-1","EUVD-2022-2379","GHSA-4gmg-gwjh-3mmr","MGASA-2016-0051","UBUNTU-CVE-2016-1927","openSUSE-SU-2024:10054-1"],"status":"published","title":"phpMyAdmin Cryptographic Vulnerability","description":"The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02688,"percentile":0.85962,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-254","CWE-255"],"published":"2016-02-05T17:26:09Z","modified":"2026-10-20T10:47:25Z","fixes":[{"ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","fixed_in":["4.0.10.13","4.4.15.3","4.5.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"phpmyadmin","fixed_in":["4:4.5.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"phpmyadmin","fixed_in":["4:4.5.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"phpmyadmin","fixed_in":["4:4.5.4-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.10.13"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.15.3"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0"},{"fixed":"4.5.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.5.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.5.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.5.4-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:3.4.11.1-2+deb7u3"}]}],"versions":["4:3.4.11.1-2","4:3.4.11.1-2+deb7u1","4:3.4.11.1-2+deb7u2"],"bundled":7},{"source":"osv","ecosystem":"Debian:8","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.2.12-2+deb8u2"}]}],"versions":["4:4.2.12-2","4:4.2.12-2+deb8u1"],"bundled":13},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.10.13"}]}],"versions":["4.0.0","4.0.1","4.0.10","4.0.10.1","4.0.10.2","4.0.10.3","4.0.10.4","4.0.10.5","4.0.10.6","4.0.10.7","4.0.10.8","4.0.10.9","4.0.2","4.0.3","4.0.4","4.0.4.1","4.0.4.2","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9"]},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.15.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0"},{"fixed":"4.5.4"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.15.4-1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"phpseclib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.0.6-1","4:4.0.8-1","4:4.0.9-1","4:4.0.10-1","4:4.0.10-1ubuntu0.1","4:4.0.10-1ubuntu0.1+esm1","4:4.0.10-1ubuntu0.1+esm2","4:4.0.10-1ubuntu0.1+esm3","4:4.0.10-1ubuntu0.1+esm4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.5.2-1.1"}]}],"bundled":124}],"products":[{"vendor":"phpmyadmin","product":"phpmyadmin"}],"references":[{"url":"http://www.phpmyadmin.net/home_page/security/PMASA-2016-4.php","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3627","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/8dedcc1a175eb07debd4fe116407c43694c60b22","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/912856b432d794201884c36e5f390d446339b6e4","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1927","tags":["advisory"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/2369daa7f5f550797f560e6b46a021e4558c2d72","tags":["web"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/5530a72e162fab442218486a90ff3365c96fde98","tags":["web"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/6a96e67487f2faecb4de4204fee9b96b94020720","tags":["web"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/8b6737735be5787d0b98c6cdfe2c7e3131b1bc95","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4gmg-gwjh-3mmr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-1927","tags":["advisory"]},{"url":"https://github.com/phpmyadmin/phpmyadmin","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2016-0051.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17633","tags":["report"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-1/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-2/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-3/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-4/","tags":["web","report"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-5/","tags":["web"]},{"url":"https://www.phpmyadmin.net/files/4.4.15.3/","tags":["web"]},{"url":"https://www.phpmyadmin.net/news/2016/1/28/phpmyadmin-454-44153-and-401013-are-released/","tags":["web"]},{"url":"https://www.phpmyadmin.net/news/2016/1/29/phpmyadmin-401014-44154-and-451/","tags":["web"]},{"url":"http://lwn.net/Vulnerabilities/674259/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-1927","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1927","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9866","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-1927","description":"The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.","status":"published","published":"2016-02-20T01:00:00Z","modified":"2024-08-05T23:10:40.298Z","updated_at":"2026-11-02T14:33:36.175943Z"}],"euvd":[{"id":"EUVD-2022-2379","description":"The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.","status":"published","published":"2016-02-20T01:00:00Z","modified":"2024-08-05T23:10:40Z","updated_at":"2026-11-03T02:22:55.100655Z"}],"ghsa":[{"id":"GHSA-4gmg-gwjh-3mmr","title":"phpMyAdmin Cryptographic Vulnerability","description":"The `suggestPassword` function in `js/functions.js` in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the `Math.random` JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.","status":"published","published":"2022-05-17T03:43:03Z","modified":"2023-11-07T20:11:10Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T14:37:15.931647Z"}],"nvd":[{"id":"CVE-2016-1927","description":"The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.","status":"published","published":"2016-02-20T01:59:00.14Z","modified":"2026-06-17T00:42:52.697Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-254","CWE-255"],"updated_at":"2026-11-02T14:03:22.479119Z"}],"osv":[{"id":"CVE-2016-1927","description":"The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.","status":"published","published":"2016-02-20T01:59:00.14Z","modified":"2026-10-20T10:47:25.756185878Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-1927","description":"The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.","status":"published","published":"2016-02-20T01:59:00.14Z","modified":"2026-09-22T07:01:16.417102229Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"GHSA-4gmg-gwjh-3mmr","title":"phpMyAdmin Cryptographic Vulnerability","description":"The `suggestPassword` function in `js/functions.js` in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the `Math.random` JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.","status":"published","published":"2022-05-17T03:43:03Z","modified":"2024-12-07T05:47:39.926215Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"UBUNTU-CVE-2016-1927","description":"The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.","status":"published","published":"2016-02-20T01:59:00Z","modified":"2025-09-08T16:43:36Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"DLA-481-1","title":"phpmyadmin - security update","status":"published","published":"2016-05-18T00:00:00Z","modified":"2026-03-09T02:10:06.898037Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3627-1","title":"phpmyadmin - security update","status":"published","published":"2016-07-24T00:00:00Z","modified":"2026-03-09T01:21:28.507061Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0051","title":"Updated phpmyadmin/phpseclib packages fix security vulnerability","description":"Password suggestion functionality uses Math.random() which does not\nprovide cryptographically secure random numbers (CVE-2016-1927).\n\nBy calling some scripts that are part of phpMyAdmin in an unexpected way,\nit is possible to trigger phpMyAdmin to display a PHP error message which\ncontains the full path of the directory where phpMyAdmin is installed\n(CVE-2016-2038).\n\nThe XSRF/CSRF token is generated with a weak algorithm using functions\nthat do not return cryptographically secure values (CVE-2016-2039).\n\nWith a crafted table name it is possible to trigger an XSS attack in the\ndatabase search page. With a crafted SET value or a crafted search query,\nit is possible to trigger an XSS attacks in the zoom search page. With a\ncrafted hostname header, it is possible to trigger an XSS attacks in the\nhome page (CVE-2016-2040).\n\nThe comparison of the XSRF/CSRF token parameter with the value saved in\nthe session is vulnerable to timing attacks. Moreover, the comparison\ncould be bypassed if the XSRF/CSRF token matches a particular pattern\n(CVE-2016-2041).\n\nThe phpmyadmin package has been updated to version 4.4.15.4 in the 4.4.x\nstable branch, and the phpseclib dependency has been updated to version\n2.0.1.\n","status":"published","published":"2016-02-05T17:26:09Z","modified":"2026-04-16T06:24:43.454536383Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10054-1","title":"phpMyAdmin-4.6.5.2-1.1 on GA media","description":"These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:59.433224Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}