AdminNeo is a PHP database management tool that exposes an unauthenticated ?script=version endpoint. The endpoint accepts POST data without any origin, CSRF or parameter-type validation, allowing a malicious actor to inject a version[] parameter that becomes a PHP array. This array is serialized into a shared adminneo.version cache and later passes through cookie() and rawurlencode(), which trigger a TypeError instead of encoding a normal string version. The result is a consistent HTTP 500 response for every user who accesses the application while the cached value persists, producing a persistent denial of service lasting up to twenty-four hours or until the cache is cleared.

The vulnerability affects the AdminNeo application (adminneo-org:adminneo) running versions 4.6.2 through 5.5.0 inclusive. Administrators of these releases are at risk until they upgrade to version 5.5.0 where the flaw has been fixed.

The CVSS score of 7.5 indicates a high impact vulnerability that is exploitable over the web without authentication. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it may not yet be widely exploited in the wild. Exploitation requires that the web server can write to the shared cache; therefore, an intermediate mitigation is to make that cache directory unwriteable. Once the cache is poisoned, all users experience failures until the cache expires or its contents are removed, making the complaint a security resource denial rather than a breach of confidentiality or integrity.