{"items":[{"id":"NVI-00003958","kind":"vulnerability","title":"AdminNeo: version-cache array injection causes persistent denial of service","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-jm85-8cpp-9cjc","CVE-2026-59978"],"plain_summary":"GitHub lists this reviewed advisory for adminneo-org/adminneo. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0eb49b0e2dbc65c1af65a99f4192aeb9"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 5.5.0 for adminneo-org/adminneo. Confirm the publisher’s latest guidance.","source_ids":["sr-51d26d4d8b246796a734e708c2998c35"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-30T18:53:08.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-b8d0b577783f6becc6810ae7a49c1859"},{"kind":"CVSS","as_of":"2026-10-30T20:17:10.567Z","value":"7.5 HIGH (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-c8b26f33e0387d5d73f9acce0298fa11"},{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.646%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.50973. Missing scores are unknown.","source_id":"sr-0eb49b0e2dbc65c1af65a99f4192aeb9"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b8d0b577783f6becc6810ae7a49c1859","url":"https://github.com/advisories/GHSA-jm85-8cpp-9cjc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-jm85-8cpp-9cjc","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:55:49.621Z"},{"id":"sr-51d26d4d8b246796a734e708c2998c35","url":"https://github.com/advisories/GHSA-jm85-8cpp-9cjc","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-jm85-8cpp-9cjc","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:30.967Z"},{"id":"sr-c8b26f33e0387d5d73f9acce0298fa11","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59978","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-59978","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T07:24:49.802Z"},{"id":"sr-0eb49b0e2dbc65c1af65a99f4192aeb9","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-59978","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.284Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b8d0b577783f6becc6810ae7a49c1859"],"technology":"adminneo-org/adminneo","known_exclusions":[],"conditions_summary":"### Summary\nAdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to `?script=version`. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST `version[]` parameter which PHP converts to an array. On next page load, function `rawurlencode()` receives this array instead of string and throws `TypeError`, returning HTTP 500 to all users for the next 24 hours.\n\nOriginally reported by @JoyGhoshs in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh\nAlthough the version checking process was modified in AdminNeo, the root cause persisted.\n\n### Workaround\nIf you can't upgrade, make the file `adminneo.version` in temp directory (usually the value of upload_tmp_dir) unwritable by web server.\n\n### Details\n#### 1. Intended design of `?script=version`\nThe endpoint is designed to receive version data from GitHub via browser JavaScript.\n- `functions.js` line 110-121: Receives the latest release information from GitHub API by AJAX.\n- JavaScript POSTs version number to `?script=version`.\n- Server ","public_affected_ranges":[">= 4.6.2, < 5.5.0"]},{"certainty":"source_listed","source_ids":["sr-51d26d4d8b246796a734e708c2998c35"],"technology":"adminneo-org/adminneo","known_exclusions":[],"conditions_summary":"### Summary\nAdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to `?script=version`. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST `version[]` parameter which PHP converts to an array. On next page load, function `rawurlencode()` receives this array instead of string and throws `TypeError`, returning HTTP 500 to all users for the next 24 hours.\n\nOriginally reported by @JoyGhoshs in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh\nAlthough the version checking process was modified in AdminNeo, the root cause persisted.\n\n### Workaround\nIf you can't upgrade, make the file `adminneo.version` in temp directory (usually the value of upload_tmp_dir) unwritable by web server.\n\n### Details\n#### 1. Intended design of `?script=version`\nThe endpoint is designed to receive version data from GitHub via browser JavaScript.\n- `functions.js` line 110-121: Receives the latest release information from GitHub API by AJAX.\n- JavaScript POSTs version number to `?script=version`.\n- Server ","public_affected_ranges":["ECOSYSTEM: introduced 4.6.2; fixed 5.5.0"]}],"null_published_at":"2026-11-07T22:29:23.425Z","source_updated_at":"2026-10-30T18:53:08.000Z","source_disclosed_at":"2026-10-30T18:53:08.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:42:30.967Z"},{"id":"NVI-00003958","kind":"vulnerability","title":"AdminNeo: version-cache array injection causes persistent denial of service","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-jm85-8cpp-9cjc","CVE-2026-59978"],"plain_summary":"GitHub lists this reviewed advisory for adminneo-org/adminneo. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0eb49b0e2dbc65c1af65a99f4192aeb9"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 5.5.0 for adminneo-org/adminneo. Confirm the publisher’s latest guidance.","source_ids":["sr-51d26d4d8b246796a734e708c2998c35"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-30T18:53:08.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-b8d0b577783f6becc6810ae7a49c1859"},{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.646%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.50973. Missing scores are unknown.","source_id":"sr-0eb49b0e2dbc65c1af65a99f4192aeb9"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b8d0b577783f6becc6810ae7a49c1859","url":"https://github.com/advisories/GHSA-jm85-8cpp-9cjc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-jm85-8cpp-9cjc","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:55:49.621Z"},{"id":"sr-51d26d4d8b246796a734e708c2998c35","url":"https://github.com/advisories/GHSA-jm85-8cpp-9cjc","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-jm85-8cpp-9cjc","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:30.967Z"},{"id":"sr-0eb49b0e2dbc65c1af65a99f4192aeb9","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-59978","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.284Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b8d0b577783f6becc6810ae7a49c1859"],"technology":"adminneo-org/adminneo","known_exclusions":[],"conditions_summary":"### Summary\nAdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to `?script=version`. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST `version[]` parameter which PHP converts to an array. On next page load, function `rawurlencode()` receives this array instead of string and throws `TypeError`, returning HTTP 500 to all users for the next 24 hours.\n\nOriginally reported by @JoyGhoshs in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh\nAlthough the version checking process was modified in AdminNeo, the root cause persisted.\n\n### Workaround\nIf you can't upgrade, make the file `adminneo.version` in temp directory (usually the value of upload_tmp_dir) unwritable by web server.\n\n### Details\n#### 1. Intended design of `?script=version`\nThe endpoint is designed to receive version data from GitHub via browser JavaScript.\n- `functions.js` line 110-121: Receives the latest release information from GitHub API by AJAX.\n- JavaScript POSTs version number to `?script=version`.\n- Server ","public_affected_ranges":[">= 4.6.2, < 5.5.0"]},{"certainty":"source_listed","source_ids":["sr-51d26d4d8b246796a734e708c2998c35"],"technology":"adminneo-org/adminneo","known_exclusions":[],"conditions_summary":"### Summary\nAdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to `?script=version`. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST `version[]` parameter which PHP converts to an array. On next page load, function `rawurlencode()` receives this array instead of string and throws `TypeError`, returning HTTP 500 to all users for the next 24 hours.\n\nOriginally reported by @JoyGhoshs in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh\nAlthough the version checking process was modified in AdminNeo, the root cause persisted.\n\n### Workaround\nIf you can't upgrade, make the file `adminneo.version` in temp directory (usually the value of upload_tmp_dir) unwritable by web server.\n\n### Details\n#### 1. Intended design of `?script=version`\nThe endpoint is designed to receive version data from GitHub via browser JavaScript.\n- `functions.js` line 110-121: Receives the latest release information from GitHub API by AJAX.\n- JavaScript POSTs version number to `?script=version`.\n- Server ","public_affected_ranges":["ECOSYSTEM: introduced 4.6.2; fixed 5.5.0"]}],"null_published_at":"2026-11-03T17:49:18.460Z","source_updated_at":"2026-10-30T18:53:08.000Z","source_disclosed_at":"2026-10-30T18:53:08.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:30.967Z"},{"id":"NVI-00003958","kind":"vulnerability","title":"AdminNeo: version-cache array injection causes persistent denial of service","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-jm85-8cpp-9cjc","CVE-2026-59978"],"plain_summary":"GitHub lists this reviewed advisory for adminneo-org/adminneo. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-b8d0b577783f6becc6810ae7a49c1859"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 5.5.0 for adminneo-org/adminneo. Confirm the publisher’s latest guidance.","source_ids":["sr-51d26d4d8b246796a734e708c2998c35"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-30T18:53:08.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-b8d0b577783f6becc6810ae7a49c1859"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b8d0b577783f6becc6810ae7a49c1859","url":"https://github.com/advisories/GHSA-jm85-8cpp-9cjc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-jm85-8cpp-9cjc","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:55:49.621Z"},{"id":"sr-51d26d4d8b246796a734e708c2998c35","url":"https://github.com/advisories/GHSA-jm85-8cpp-9cjc","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-jm85-8cpp-9cjc","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:30.967Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b8d0b577783f6becc6810ae7a49c1859"],"technology":"adminneo-org/adminneo","known_exclusions":[],"conditions_summary":"### Summary\nAdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to `?script=version`. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST `version[]` parameter which PHP converts to an array. On next page load, function `rawurlencode()` receives this array instead of string and throws `TypeError`, returning HTTP 500 to all users for the next 24 hours.\n\nOriginally reported by @JoyGhoshs in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh\nAlthough the version checking process was modified in AdminNeo, the root cause persisted.\n\n### Workaround\nIf you can't upgrade, make the file `adminneo.version` in temp directory (usually the value of upload_tmp_dir) unwritable by web server.\n\n### Details\n#### 1. Intended design of `?script=version`\nThe endpoint is designed to receive version data from GitHub via browser JavaScript.\n- `functions.js` line 110-121: Receives the latest release information from GitHub API by AJAX.\n- JavaScript POSTs version number to `?script=version`.\n- Server ","public_affected_ranges":[">= 4.6.2, < 5.5.0"]},{"certainty":"source_listed","source_ids":["sr-51d26d4d8b246796a734e708c2998c35"],"technology":"adminneo-org/adminneo","known_exclusions":[],"conditions_summary":"### Summary\nAdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to `?script=version`. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST `version[]` parameter which PHP converts to an array. On next page load, function `rawurlencode()` receives this array instead of string and throws `TypeError`, returning HTTP 500 to all users for the next 24 hours.\n\nOriginally reported by @JoyGhoshs in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh\nAlthough the version checking process was modified in AdminNeo, the root cause persisted.\n\n### Workaround\nIf you can't upgrade, make the file `adminneo.version` in temp directory (usually the value of upload_tmp_dir) unwritable by web server.\n\n### Details\n#### 1. Intended design of `?script=version`\nThe endpoint is designed to receive version data from GitHub via browser JavaScript.\n- `functions.js` line 110-121: Receives the latest release information from GitHub API by AJAX.\n- JavaScript POSTs version number to `?script=version`.\n- Server ","public_affected_ranges":["ECOSYSTEM: introduced 4.6.2; fixed 5.5.0"]}],"null_published_at":"2026-10-31T22:13:31.284Z","source_updated_at":"2026-10-30T18:53:08.000Z","source_disclosed_at":"2026-10-30T18:53:08.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:42:30.967Z"}],"next_cursor":null,"snapshot_revision":"42594"}