{"id":"CVE-2026-59978","published":"2026-10-30T19:18:27.480","lastModified":"2026-10-30T20:17:10.567","description":"AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSRF or parameter-type validation. A `version[]` parameter becomes a PHP array that `bootstrap.inc.php` serializes into the shared `adminneo.version` cache. On later page loads, `design.inc.php` passes that cached value to `cookie()` and `rawurlencode()`, causing a `TypeError` rather than encoding a version string. A remote attacker can make the instance return HTTP 500 to all users for the cache's twenty-four-hour lifetime or until the poisoned cache is removed. Exploitation requires the web server to be able to write that shared cache; making it unwritable is an interim workaround. The issue retains the underlying type-validation defect reported previously in Adminer despite changes to AdminNeo's version-checking flow. This issue is fixed in version 5.5.0.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-20"],"vendors":[],"products":[],"references":[{"url":"https://github.com/adminneo-org/adminneo/commit/b7ae929e6afb374f0a7aba3d73b7d441470ff907","tags":[]},{"url":"https://github.com/adminneo-org/adminneo/releases/tag/v5.5.0","tags":[]},{"url":"https://github.com/adminneo-org/adminneo/security/advisories/GHSA-jm85-8cpp-9cjc","tags":[]}],"exploitRefs":[{"url":"https://github.com/adminneo-org/adminneo/commit/b7ae929e6afb374f0a7aba3d73b7d441470ff907","tags":[]},{"url":"https://github.com/adminneo-org/adminneo/releases/tag/v5.5.0","tags":[]},{"url":"https://github.com/adminneo-org/adminneo/security/advisories/GHSA-jm85-8cpp-9cjc","tags":[]}],"hasPoc":true,"ai":null}