Search for vulnerabilities
Vulnerability details: VCID-rspx-kym8-xydx
Vulnerability ID VCID-rspx-kym8-xydx
Aliases CVE-2016-5730
GHSA-wm9c-vcv2-vpqc
Summary phpMyAdmin full path disclosure vulnerability phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 5.3 http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html
generic_textual MODERATE http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html
cvssv3.1 5.3 http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html
generic_textual MODERATE http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
epss 0.00954 https://api.first.org/data/v1/epss?cve=CVE-2016-5730
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-wm9c-vcv2-vpqc
cvssv3.1 5.3 https://github.com/phpmyadmin/composer
generic_textual MODERATE https://github.com/phpmyadmin/composer
cvssv3.1 5.3 https://github.com/phpmyadmin/phpmyadmin/commit/27664605b945b13e1d2b71adea822ace2099cc96
generic_textual MODERATE https://github.com/phpmyadmin/phpmyadmin/commit/27664605b945b13e1d2b71adea822ace2099cc96
cvssv3.1 5.3 https://github.com/phpmyadmin/phpmyadmin/commit/331c560fbfa0e7d2dce674b5e88e983c5f2a451d
generic_textual MODERATE https://github.com/phpmyadmin/phpmyadmin/commit/331c560fbfa0e7d2dce674b5e88e983c5f2a451d
cvssv3.1 5.3 https://github.com/phpmyadmin/phpmyadmin/commit/96e0aa35653ec0c66084a7e9343465e16c1f769b
generic_textual MODERATE https://github.com/phpmyadmin/phpmyadmin/commit/96e0aa35653ec0c66084a7e9343465e16c1f769b
cvssv3.1 5.3 https://github.com/phpmyadmin/phpmyadmin/commit/b0180f18c828706af3a6800f0fb01a536d3ef8c7
generic_textual MODERATE https://github.com/phpmyadmin/phpmyadmin/commit/b0180f18c828706af3a6800f0fb01a536d3ef8c7
cvssv3.1 5.3 https://github.com/phpmyadmin/phpmyadmin/commit/cd229d718e8cb4bc8ba32446beaa82d27727b6f0
generic_textual MODERATE https://github.com/phpmyadmin/phpmyadmin/commit/cd229d718e8cb4bc8ba32446beaa82d27727b6f0
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2016-5730
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2016-5730
cvssv3.1 5.3 https://security.gentoo.org/glsa/201701-32
generic_textual MODERATE https://security.gentoo.org/glsa/201701-32
cvssv3.1 5.3 https://www.phpmyadmin.net/security/PMASA-2016-23
generic_textual MODERATE https://www.phpmyadmin.net/security/PMASA-2016-23
cvssv3.1 5.3 http://www.securityfocus.com/bid/91379
generic_textual MODERATE http://www.securityfocus.com/bid/91379
Reference id Reference type URL
http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html
http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html
https://api.first.org/data/v1/epss?cve=CVE-2016-5730
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5730
https://github.com/phpmyadmin/composer
https://github.com/phpmyadmin/phpmyadmin/commit/27664605b945b13e1d2b71adea822ace2099cc96
https://github.com/phpmyadmin/phpmyadmin/commit/331c560fbfa0e7d2dce674b5e88e983c5f2a451d
https://github.com/phpmyadmin/phpmyadmin/commit/96e0aa35653ec0c66084a7e9343465e16c1f769b
https://github.com/phpmyadmin/phpmyadmin/commit/b0180f18c828706af3a6800f0fb01a536d3ef8c7
https://github.com/phpmyadmin/phpmyadmin/commit/cd229d718e8cb4bc8ba32446beaa82d27727b6f0
https://nvd.nist.gov/vuln/detail/CVE-2016-5730
https://security.gentoo.org/glsa/201701-32
https://www.phpmyadmin.net/security/PMASA-2016-23
https://www.phpmyadmin.net/security/PMASA-2016-23/
http://www.securityfocus.com/bid/91379
GHSA-wm9c-vcv2-vpqc https://github.com/advisories/GHSA-wm9c-vcv2-vpqc
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/phpmyadmin/composer
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/phpmyadmin/phpmyadmin/commit/27664605b945b13e1d2b71adea822ace2099cc96
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/phpmyadmin/phpmyadmin/commit/331c560fbfa0e7d2dce674b5e88e983c5f2a451d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/phpmyadmin/phpmyadmin/commit/96e0aa35653ec0c66084a7e9343465e16c1f769b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/phpmyadmin/phpmyadmin/commit/b0180f18c828706af3a6800f0fb01a536d3ef8c7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/phpmyadmin/phpmyadmin/commit/cd229d718e8cb4bc8ba32446beaa82d27727b6f0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2016-5730
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://security.gentoo.org/glsa/201701-32
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://www.phpmyadmin.net/security/PMASA-2016-23
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at http://www.securityfocus.com/bid/91379
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.75463
EPSS Score 0.00954
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T09:14:55.676177+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-wm9c-vcv2-vpqc/GHSA-wm9c-vcv2-vpqc.json 37.0.0