CVE-2016-6629

9.8 criticalEPSS 3.2%

An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.2% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CWE: CWE-254
Published: 2016-12-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

phpmyadmin:phpmyadmin

References

http://www.securityfocus.com/bid/92493
https://security.gentoo.org/glsa/201701-32
https://www.phpmyadmin.net/security/PMASA-2016-52
http://www.securityfocus.com/bid/92493
https://security.gentoo.org/glsa/201701-32

Check your stack JSON