Search for vulnerabilities
Vulnerability details: VCID-qxgd-ufvd-nue7
Vulnerability ID VCID-qxgd-ufvd-nue7
Aliases CVE-2016-2040
GHSA-pw34-qf6c-84fc
Summary phpMyAdmin XSS Vulnerability Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) hostname in a Location header.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 5.4 http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html
generic_textual MODERATE http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html
cvssv3.1 5.4 http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html
generic_textual MODERATE http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html
cvssv3.1 5.4 http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html
generic_textual MODERATE http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html
cvssv3.1 5.4 http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html
generic_textual MODERATE http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
epss 0.00507 https://api.first.org/data/v1/epss?cve=CVE-2016-2040
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-pw34-qf6c-84fc
cvssv3.1 5.4 https://github.com/phpmyadmin/phpmyadmin/commit/75a55824012406a08c4debf5ddb7ae41c32a7dbc
generic_textual MODERATE https://github.com/phpmyadmin/phpmyadmin/commit/75a55824012406a08c4debf5ddb7ae41c32a7dbc
cvssv3.1 5.4 https://github.com/phpmyadmin/phpmyadmin/commit/aca42efa01917cc0fe8cfdb2927a6399ca1742f2
generic_textual MODERATE https://github.com/phpmyadmin/phpmyadmin/commit/aca42efa01917cc0fe8cfdb2927a6399ca1742f2
cvssv3.1 5.4 https://github.com/phpmyadmin/phpmyadmin/commit/edffb52884b09562490081c3b8666ef46c296418
generic_textual MODERATE https://github.com/phpmyadmin/phpmyadmin/commit/edffb52884b09562490081c3b8666ef46c296418
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2016-2040
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2016-2040
cvssv3.1 5.4 http://www.debian.org/security/2016/dsa-3627
generic_textual MODERATE http://www.debian.org/security/2016/dsa-3627
cvssv3.1 5.4 http://www.phpmyadmin.net/home_page/security/PMASA-2016-3.php
generic_textual MODERATE http://www.phpmyadmin.net/home_page/security/PMASA-2016-3.php
Reference id Reference type URL
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html
https://api.first.org/data/v1/epss?cve=CVE-2016-2040
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1927
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2039
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2040
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2041
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2560
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2561
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5099
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5701
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5705
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5706
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5731
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5733
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5739
https://github.com/phpmyadmin/phpmyadmin/commit/75a55824012406a08c4debf5ddb7ae41c32a7dbc
https://github.com/phpmyadmin/phpmyadmin/commit/aca42efa01917cc0fe8cfdb2927a6399ca1742f2
https://github.com/phpmyadmin/phpmyadmin/commit/edffb52884b09562490081c3b8666ef46c296418
https://nvd.nist.gov/vuln/detail/CVE-2016-2040
http://www.debian.org/security/2016/dsa-3627
http://www.phpmyadmin.net/home_page/security/PMASA-2016-3.php
GHSA-pw34-qf6c-84fc https://github.com/advisories/GHSA-pw34-qf6c-84fc
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/phpmyadmin/phpmyadmin/commit/75a55824012406a08c4debf5ddb7ae41c32a7dbc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/phpmyadmin/phpmyadmin/commit/aca42efa01917cc0fe8cfdb2927a6399ca1742f2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/phpmyadmin/phpmyadmin/commit/edffb52884b09562490081c3b8666ef46c296418
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2016-2040
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at http://www.debian.org/security/2016/dsa-3627
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at http://www.phpmyadmin.net/home_page/security/PMASA-2016-3.php
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.65253
EPSS Score 0.00507
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T09:16:33.661612+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pw34-qf6c-84fc/GHSA-pw34-qf6c-84fc.json 37.0.0