CVE-2016-5734

CVE-2016-5734 is a critical remote code execution vulnerability affecting phpMyAdmin versions 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3. The flaw stems from improper delimiter handling in the preg_replace function, allowing attackers to execute arbitrary PHP code, notably through the table search-and-replace feature. This vulnerability carries a CVSS score of 9.8 (CRITICAL), indicating a severe risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. The high EPSS score and FAUCET Risk Score of 100/100 further emphasize its significant exploitability and potential impact. While not listed on the CISA KEV catalog, exploit intelligence confirms the existence of public exploit code, including a Metasploit module and an ExploitDB entry for authenticated remote code execution. Despite the availability of exploit code, there is minimal community discussion or media coverage surrounding this CVE.