PatchClock

PHP security digest · Packages

adminneo-org/adminneo security advisories

7 advisories we have followed since September 2026, 5 of them critical or high, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. Medium 30 Oct 2026

    AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE

    Fixed in 5.5.1 · CVE-2026-96634

  2. High 30 Oct 2026

    AdminNeo SQLite Database-List Drop Arbitrary File Deletion

    Fixed in 5.5.1 · CVE-2026-96633

  3. High 30 Oct 2026

    AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers

    Fixed in 5.5.1 · CVE-2026-96631

  4. High 30 Oct 2026

    AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)

    Fixed in 5.5.1 · CVE-2026-96632

  5. High 30 Oct 2026

    AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)

    Fixed in 5.5.1 · CVE-2026-96630

  6. Medium 30 Oct 2026

    AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery

    Fixed in 5.5.1 · CVE-2026-96629

  7. High 30 Oct 2026

    AdminNeo: version-cache array injection causes persistent denial of service

    Fixed in 5.5.0 · CVE-2026-59978

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including adminneo-org/adminneo, and the version that fixes it.