phpMyAdmin Cross-site Scripting (XSS)

MEDIUM 6.1CVE-2016-6608 · GHSA-jfmj-27fp-qp67 · Published 11/12/2016 · updated 17/06/2026

In short

CVE-2016-6608 is a MEDIUM (CVSS 6.1) vulnerability affecting phpmyadmin/phpmyadmin, phpmyadmin (phpmyadmin).
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 70.0% of all vulnerabilities.
Fix: update to 4.6.4 or later.

Package	Affected versions	Patched versions
phpmyadmin/phpmyadmin Packagist	`≥ 4.6, < 4.6.4`	`4.6.4`
phpmyadmin phpmyadmin	`= 4.6.0= 4.6.1= 4.6.2= 4.6.3`	No fix yet

Description

XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2016-6608 · ADVISORY
phpmyadmin/composer · PACKAGE
security.gentoo.org/glsa/201701-32 · WEB
phpmyadmin.net/security/PMASA-2016-31 · WEB
securityfocus.com/bid/93258 · WEB

More vulnerabilities in phpmyadmin/phpmyadmin

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

phpmyadmin/phpmyadmin

Packagist

≥ 4.6, < 4.6.4

4.6.4

phpmyadmin

= 4.6.0= 4.6.1= 4.6.2= 4.6.3

No fix yet

Description

NVD description

More vulnerabilities in phpmyadmin/phpmyadmin

See all →