[MEDIUM] AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE

PKSA-3qwh-zmfw-wy96 CVE-2026-96634 GHSA-p96f-p2p2-2g3h

Affected version: <5.5.1

Reported by:
GitHub

[HIGH] AdminNeo SQLite Database-List Drop Arbitrary File Deletion

PKSA-crwk-5zq2-p7sx CVE-2026-96633 GHSA-6vfx-w7q3-42gq

Affected version: <5.5.1

Reported by:
GitHub

[HIGH] AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers

PKSA-31n1-gk84-zwsg CVE-2026-96631 GHSA-79wv-8rh2-9vp2

Affected version: >=4.6.0,<5.5.1

Reported by:
GitHub

[HIGH] AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)

PKSA-jqcq-6phr-785g CVE-2026-96632 GHSA-rx7m-wxwq-vxr9

Affected version: <5.5.1

Reported by:
GitHub

[HIGH] AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)

PKSA-z44r-b4tk-ggk6 CVE-2026-96630 GHSA-q5mp-gfjf-cf2j

Affected version: <5.5.1

Reported by:
GitHub

[MEDIUM] AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery

PKSA-1q5j-gcpm-qr2y CVE-2026-96629 GHSA-wm25-49w3-5qrg

Affected version: <5.5.1

Reported by:
GitHub

[HIGH] AdminNeo: version-cache array injection causes persistent denial of service

PKSA-j37s-v4jh-54ry CVE-2026-59978 GHSA-jm85-8cpp-9cjc

Affected version: >=4.6.2,<5.5.0

Reported by:
GitHub