CVE-2016-5730

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.

• CWE-200

• http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html
• http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html
• http://www.securityfocus.com/bid/91379
• https://github.com/phpmyadmin/phpmyadmin/commit/27664605b945b13e1d2b71adea822ace2099cc96Patch
• https://github.com/phpmyadmin/phpmyadmin/commit/331c560fbfa0e7d2dce674b5e88e983c5f2a451dPatch
• https://github.com/phpmyadmin/phpmyadmin/commit/96e0aa35653ec0c66084a7e9343465e16c1f769bPatch
• https://github.com/phpmyadmin/phpmyadmin/commit/b0180f18c828706af3a6800f0fb01a536d3ef8c7Patch
• https://github.com/phpmyadmin/phpmyadmin/commit/cd229d718e8cb4bc8ba32446beaa82d27727b6f0Patch
• https://security.gentoo.org/glsa/201701-32
• https://www.phpmyadmin.net/security/PMASA-2016-23/Patch, Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html
• http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html
• http://www.securityfocus.com/bid/91379
• https://github.com/phpmyadmin/phpmyadmin/commit/27664605b945b13e1d2b71adea822ace2099cc96Patch
• https://github.com/phpmyadmin/phpmyadmin/commit/331c560fbfa0e7d2dce674b5e88e983c5f2a451dPatch
• https://github.com/phpmyadmin/phpmyadmin/commit/96e0aa35653ec0c66084a7e9343465e16c1f769bPatch
• https://github.com/phpmyadmin/phpmyadmin/commit/b0180f18c828706af3a6800f0fb01a536d3ef8c7Patch
• https://github.com/phpmyadmin/phpmyadmin/commit/cd229d718e8cb4bc8ba32446beaa82d27727b6f0Patch
• https://security.gentoo.org/glsa/201701-32
• https://www.phpmyadmin.net/security/PMASA-2016-23/Patch, Vendor Advisory

Published

Jul 3, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-5724Cloudera CDH before 5.9 has Potentially Sensitive Informatio…7.5
• CVE-2016-5725Directory traversal vulnerability in JCraft JSch before 0.1.…
• CVE-2016-5726Packages.php in Simple Machines Forum (SMF) 2.1 allows remot…
• CVE-2016-5727LogInOut.php in Simple Machines Forum (SMF) 2.1 allows remot…
• CVE-2016-5728Race condition in the vop_ioctl function in drivers/misc/mic…
• CVE-2016-5729Lenovo BIOS EFI Driver allows local administrators to execut…8.2
• CVE-2016-5731Cross-site scripting (XSS) vulnerability in examples/openid.…
• CVE-2016-5732Multiple cross-site scripting (XSS) vulnerabilities in the p…
• CVE-2016-5733Multiple cross-site scripting (XSS) vulnerabilities in phpMy…
• CVE-2016-5734phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, an…
• CVE-2016-5735Integer overflow in the rwpng_read_image24_libpng function i…
• CVE-2016-5736The default configuration of the IPsec IKE peer listener in …