Servers and applications
CVE-2016-9861 An issue was discovered in phpMyAdmin. Due to the limitation in URL matching, it was possible to bypass the URL white-list protection. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Severity High 7.5
Published 11 Dec 2016
Last changed 17 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 1.8% in the next 30 daysHigher than 78% of CVEs. EPSS by FIRST , 11 Nov 2026
Attack Over the network · No login needed · No user action needed
Attacker can Change data
CVSS vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Sources NVD Affected software Software Affected versions phpMyAdminServers and applications · cpe:a:phpmyadmin:phpmyadmin Version 4.6.4 Version 4.6.3 Version 4.6.2 Version 4.6.1 All 63 release lines Version 4.0.0 Version 4.0.1 Version 4.0.2 Version 4.0.3 Version 4.0.4 Version 4.0.4.1 Version 4.0.4.2 Version 4.0.5 Version 4.0.6 Version 4.0.7 Version 4.0.8 Version 4.0.9 Version 4.0.10 Version 4.0.10.1 Version 4.0.10.2 Version 4.0.10.3 Version 4.0.10.4 Version 4.0.10.5 Version 4.0.10.6 Version 4.0.10.7 Version 4.0.10.8 Version 4.0.10.9 Version 4.0.10.10 Version 4.0.10.11 Version 4.0.10.12 Version 4.0.10.13 Version 4.0.10.14 Version 4.0.10.15 Version 4.0.10.16 Version 4.0.10.17 Version 4.4.0 Version 4.4.1 Version 4.4.1.1 Version 4.4.2 Version 4.4.3 Version 4.4.4 Version 4.4.5 Version 4.4.6 Version 4.4.6.1 Version 4.4.7 Version 4.4.8 Version 4.4.9 Version 4.4.10 Version 4.4.11 Version 4.4.12 Version 4.4.13 Version 4.4.13.1 Version 4.4.14 Version 4.4.14.1 Version 4.4.15 Version 4.4.15.1 Version 4.4.15.2 Version 4.4.15.3 Version 4.4.15.4 Version 4.4.15.5 Version 4.4.15.6 Version 4.4.15.7 Version 4.4.15.8 Version 4.6.0 Version 4.6.1 Version 4.6.2 Version 4.6.3 Version 4.6.4
References NVD https://nvd.nist.gov/vuln/detail/CVE-2016-9861 CVE.org https://www.cve.org/CVERecord?id=CVE-2016-9861