CVE-2016-6629: An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive.

Security readout for executives and security teams

This phpMyAdmin flaw can let an attacker reuse certain cookie values to bypass server restrictions configured through ArbitraryServerRegexp. For organizations relying on that control to limit which database servers phpMyAdmin can reach, the business risk is unauthorized access paths inside a database administration tool. Exposure is most likely where affected phpMyAdmin versions are deployed and ArbitraryServerRegexp is used to constrain selectable database servers. Public internet exposure would increase urgency, but the source bundle does not state exposure scope or authentication requirements. Treat this as a targeted remediation item for any phpMyAdmin deployment that depends on server allow-listing. It is not KEV-listed in the provided data, but database administration interfaces have high business impact when access controls fail. Mitigation focus: Upgrade phpMyAdmin to 4.6.4, 4.4.15.8, 4.0.10.17, or later supported releases.; Review phpMyAdmin PMASA-2016-52 for vendor-specific remediation guidance.; Prioritize systems using ArbitraryServerRegexp for database server restrictions..

Prepared

Jun 13, 2026, 13:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.