{"id":"CVE-2016-6608","aliases":["ALPINE-CVE-2016-6608","DEBIAN-CVE-2016-6608","EUVD-2022-4349","GHSA-jfmj-27fp-qp67","openSUSE-SU-2024:10054-1"],"status":"published","title":"phpMyAdmin Cross-site Scripting (XSS)","description":"XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the \"Remove partitioning\" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0128,"percentile":0.70214,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2016-12-11T02:00:00Z","modified":"2026-10-24T10:30:58Z","fixes":[{"ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","fixed_in":["4.6.4"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.2","package":"phpmyadmin","fixed_in":["4.4.15.8-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"phpmyadmin","fixed_in":["4:4.6.4+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"phpmyadmin","fixed_in":["4:4.6.4+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"phpmyadmin","fixed_in":["4:4.6.4+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6"},{"fixed":"4.6.4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.2","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.15.8-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.4+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.4+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.4+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6"},{"fixed":"4.6.4"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.5.2-1.1"}]}],"bundled":124}],"products":[{"vendor":"phpmyadmin","product":"phpmyadmin"}],"references":[{"url":"https://www.phpmyadmin.net/security/PMASA-2016-31","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"http://www.securityfocus.com/bid/93258","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201701-32","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6608","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jfmj-27fp-qp67"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-6608","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-6608","tags":["advisory"]},{"url":"https://github.com/phpmyadmin/composer","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9866","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-6608","description":"XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the \"Remove partitioning\" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.","status":"published","published":"2016-12-11T02:00:00Z","modified":"2024-08-06T01:36:28.331Z","updated_at":"2026-11-02T14:33:34.094161Z"}],"euvd":[{"id":"EUVD-2022-4349","description":"XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the \"Remove partitioning\" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.","status":"published","published":"2016-12-11T02:00:00Z","modified":"2024-08-06T01:36:28Z","updated_at":"2026-11-03T02:22:35.936009Z"}],"ghsa":[{"id":"GHSA-jfmj-27fp-qp67","title":"phpMyAdmin Cross-site Scripting (XSS)","description":"XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the \"Remove partitioning\" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.","status":"published","published":"2022-05-17T02:37:28Z","modified":"2024-04-24T18:10:32Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:45.47408Z"}],"nvd":[{"id":"CVE-2016-6608","description":"XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the \"Remove partitioning\" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.","status":"published","published":"2016-12-11T02:59:12.97Z","modified":"2026-06-17T00:51:27.093Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:32.79141Z"}],"osv":[{"id":"ALPINE-CVE-2016-6608","description":"XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the \"Remove partitioning\" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.","status":"published","published":"2016-12-11T02:59:12.97Z","modified":"2026-09-22T06:30:25.982989397Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"CVE-2016-6608","description":"XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the \"Remove partitioning\" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.","status":"published","published":"2016-12-11T02:59:12.97Z","modified":"2026-10-24T10:30:58.286189131Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-6608","description":"XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the \"Remove partitioning\" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.","status":"published","published":"2016-12-11T02:59:12.97Z","modified":"2026-09-22T07:00:50.712861734Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"GHSA-jfmj-27fp-qp67","title":"phpMyAdmin Cross-site Scripting (XSS)","description":"XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the \"Remove partitioning\" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.","status":"published","published":"2022-05-17T02:37:28Z","modified":"2024-04-24T18:28:57.615929Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"openSUSE-SU-2024:10054-1","title":"phpMyAdmin-4.6.5.2-1.1 on GA media","description":"These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:59.433224Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}