Servers and applications
CVE-2016-6609 An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
Severity High 8.8
Published 11 Dec 2016
Last changed 17 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 2.3% in the next 30 daysHigher than 83% of CVEs. EPSS by FIRST , 11 Nov 2026
Attack Over the network · Needs a user account · No user action needed
Attacker can Read data · Change data · Take it down
CVSS vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Sources NVD Affected software Software Affected versions phpMyAdminServers and applications · cpe:a:phpmyadmin:phpmyadmin Version 4.6.3 Version 4.6.2 Version 4.6.1 Version 4.6.0 All 60 release lines Version 4.0.0 Version 4.0.1 Version 4.0.2 Version 4.0.3 Version 4.0.4 Version 4.0.4.1 Version 4.0.4.2 Version 4.0.5 Version 4.0.6 Version 4.0.7 Version 4.0.8 Version 4.0.9 Version 4.0.10 Version 4.0.10.1 Version 4.0.10.2 Version 4.0.10.3 Version 4.0.10.4 Version 4.0.10.5 Version 4.0.10.6 Version 4.0.10.7 Version 4.0.10.8 Version 4.0.10.9 Version 4.0.10.10 Version 4.0.10.11 Version 4.0.10.12 Version 4.0.10.13 Version 4.0.10.14 Version 4.0.10.15 Version 4.0.10.16 Version 4.4.0 Version 4.4.1 Version 4.4.1.1 Version 4.4.2 Version 4.4.3 Version 4.4.4 Version 4.4.5 Version 4.4.6 Version 4.4.6.1 Version 4.4.7 Version 4.4.8 Version 4.4.9 Version 4.4.10 Version 4.4.11 Version 4.4.12 Version 4.4.13 Version 4.4.13.1 Version 4.4.14 Version 4.4.14.1 Version 4.4.15 Version 4.4.15.1 Version 4.4.15.2 Version 4.4.15.3 Version 4.4.15.4 Version 4.4.15.5 Version 4.4.15.6 Version 4.4.15.7 Version 4.6.0 Version 4.6.1 Version 4.6.2 Version 4.6.3
References NVD https://nvd.nist.gov/vuln/detail/CVE-2016-6609 CVE.org https://www.cve.org/CVERecord?id=CVE-2016-6609