CVE catalog

CVE-2016-9849

phpmyadmin: CVE-2016-9849

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.67% · Oct 25, 2026

An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphpmyadminsid4:5.2.4~dev~git20260809.e0909b211b+dfsg-1fixed
Debianphpmyadminforky4:5.2.4~dev~git20260809.e0909b211b+dfsg-1fixed
Debianphpmyadmintrixie4:5.2.2-really+dfsg-1+deb13u1fixed
Debianphpmyadminbookworm4:5.2.1+dfsg-1+deb12u1fixed
Alpinephpmyadmin3.24.4.15.9-r0fixed
Alpinephpmyadmin3.44.6.5.2-r0fixed
Ubuntuphpmyadminpro4:4.4.13.1-1vulnerable
Ubuntuphpmyadminpro4:4.5.0.2-2vulnerable
Ubuntuphpmyadminpro4:4.5.1-1vulnerable
Ubuntuphpmyadminpro4:4.5.1-2vulnerable
Ubuntuphpmyadminpro4:4.5.1-3vulnerable
Ubuntuphpmyadminpro4:4.5.2-1vulnerable
Ubuntuphpmyadminpro4:4.5.2-2vulnerable
Ubuntuphpmyadminpro4:4.5.3.1-1vulnerable
Ubuntuphpmyadminpro4:4.5.4-1vulnerable
Ubuntuphpmyadminpro4:4.5.4.1-2vulnerable
Ubuntuphpmyadminpro4:4.5.4.1-2ubuntu1vulnerable
Ubuntuphpmyadminpro4:4.5.4.1-2ubuntu2vulnerable
Ubuntuphpmyadminpro4:4.5.4.1-2ubuntu2.1vulnerable
Ubuntuphpmyadminpro4:4.5.4.1-2ubuntu2.1+esm2vulnerable
Ubuntuphpmyadminpro4:4.5.4.1-2ubuntu2.1+esm3vulnerable
Ubuntuphpmyadminpro4:4.5.4.1-2ubuntu2.1+esm4vulnerable
Ubuntuphpmyadminpro4:4.5.4.1-2ubuntu2.1+esm5fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphpmyadminsourcesid4:4.6.5.1-1not yet assignedNot reportedNot reported
Debianphpmyadminsourceforky4:4.6.5.1-1not yet assignedNot reportedNot reported
Debianphpmyadminsourcetrixie4:4.6.5.1-1not yet assignedNot reportedNot reported
Debianphpmyadminsourcebookworm4:4.6.5.1-1not yet assignedNot reportedNot reported
Alpinephpmyadminapk3.24.4.15.9-r0Not reportedALPINE-CVE-2016-9849Not reported
Alpinephpmyadminapk3.44.6.5.2-r0Not reportedALPINE-CVE-2016-9849Not reported
Ubuntuphpmyadmindebpro4:4.5.4.1-2ubuntu2.1+esm5Not reportedUBUNTU-CVE-2016-9849Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [phpmyadmin]Fixed
    Details (2)

    • 4:5.2.1+dfsg-1+deb12u1 · all · bookworm

      Fixed · Fixed: 4:4.6.5.1-1

      dsa · phpmyadmin · debian · bookworm; dsa · phpmyadmin · debian · 12

    • 4:5.2.1+dfsg-1+deb12u1 · all · bookworm

      Fixed · Fixed: 4:4.6.5.1-1

      dsa · phpmyadmin · debian · bookworm; dsa · phpmyadmin · debian · 12

[Debian 13 (Trixie)]

  • [phpmyadmin]Fixed
    Details (2)

    • 4:5.2.2-really+dfsg-1+deb13u1 · all · trixie

      Fixed · Fixed: 4:4.6.5.1-1

      dsa · phpmyadmin · debian · 13

    • 4:5.2.2-really+dfsg-1+deb13u1 · all · trixie

      Fixed · Fixed: 4:4.6.5.1-1

      dsa · phpmyadmin · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]