What’s Vulnerable › Vulnerabilities

CVE-2016-5734

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 81.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2016-07-03 · updated 2026-06-17
• Weakness: CWE-94

Description

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.

Affected products

• phpMyAdmin: 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4.1 (+53)

References

• http://www.securityfocus.com/bid/91387
• https://github.com/phpmyadmin/phpmyadmin/commit/1cc7466db3a05e95fe57a6702f41773e6829d54b
• https://github.com/phpmyadmin/phpmyadmin/commit/4bcc606225f15bac0b07780e74f667f6ac283da7
• https://security.gentoo.org/glsa/201701-32
• https://www.exploit-db.com/exploits/40185/
• https://www.phpmyadmin.net/security/PMASA-2016-27/
• http://www.securityfocus.com/bid/91387
• https://github.com/phpmyadmin/phpmyadmin/commit/1cc7466db3a05e95fe57a6702f41773e6829d54b
• https://github.com/phpmyadmin/phpmyadmin/commit/4bcc606225f15bac0b07780e74f667f6ac283da7
• https://security.gentoo.org/glsa/201701-32
• https://www.exploit-db.com/exploits/40185/
• https://www.phpmyadmin.net/security/PMASA-2016-27/

Get alerted when CVE-2016-5734 or the next vulnerability affects your stack