CVE-2016-6607

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

XSS issues were discovered in phpMyAdmin. This affects Zoom search (specially crafted column content can be used to trigger an XSS attack); GIS editor (certain fields in the graphical GIS editor are not properly escaped and can be used to trigger an XSS attack); Relation view; the following Transformations: Formatted, Imagelink, JPEG: Upload, RegexValidation, JPEG inline, PNG inline, and transformation wrapper; XML export; MediaWiki export; Designer; When the MySQL server is running with a specially-crafted log_bin directive; Database tab; Replication feature; and Database search. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Dec 11, 2016
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-66086.1XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially cCVE-2016-66098.8An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array exporCVE-2016-66104.3A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the export mechanism to disCVE-2016-66118.1An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack throughCVE-2016-66126.5An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database CVE-2016-66135.3An issue was discovered in phpMyAdmin. A user can specially craft a symlink on disk, to a file which phpMyAdmin is permitted to read but theCVE-2016-66146.8An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the usCVE-2016-66156.1XSS issues were discovered in phpMyAdmin. This affects navigation pane and database/table hiding feature (a specially-crafted database name CVE-2016-66167.5An issue was discovered in phpMyAdmin. In the "User group" and "Designer" features, a user can execute an SQL injection attack against the aCVE-2016-66178.1An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack throughCVE-2016-66186.5An issue was discovered in phpMyAdmin. The transformation feature allows a user to trigger a denial-of-service (DoS) attack against the servCVE-2016-66198.8An issue was discovered in phpMyAdmin. In the user interface preference feature, a user can execute an SQL injection attack against the acco
CVE-2016-6607: Medium severity, CVSS 6.1 | Vulnix