adminneo-org/adminneo vulnerabilities
CVEs whose affected-version data names the adminneo-org/adminneo package (composer). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-96629Medium· 6.8AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery
AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery
CVE-2026-96632HighAdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)
AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)
CVE-2026-96630High· 7.2AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)
AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)
CVE-2026-96634MediumAdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE
AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE
CVE-2026-96633High· 8.1AdminNeo SQLite Database-List Drop Arbitrary File Deletion
AdminNeo SQLite Database-List Drop Arbitrary File Deletion
CVE-2026-96631High· 8.2AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers
AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers
CVE-2026-59978High· 7.5AdminNeo: version-cache array injection causes persistent denial of service
AdminNeo: version-cache array injection causes persistent denial of service