8.2
High
AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)
CVE-2026-96632
Summary AdminNeo inserts the database server's version string into a The browser executes alert(origin) with full CSP bypass because the script tag carries a valid nonce. 3. Trigger it via Login CSRF The login form has no CSRF token. An attacker page auto-submits the login, forcing the victim's browser to connect to the rogue server: html Collaborator Request This vulnerability was discovered jointly with Yashar Shahinzadeh (GitHub: @Voorivex). Could you please add him as a collaborator on this advisory and credit him as a co-discoverer? Thank you!
Assessment
- CVSS
- 8.2 (v4.0)
- Severity
- High
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 30 October 2026
- Last updated
- 30 October 2026
- Affected
- composer · adminneo-org/adminneo
- Weakness
- CWE-79
CVSS vectorCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
At the source
References
- https://github.com/adminneo-org/adminneo/security/advisories/GHSA-rx7m-wxwq-vxr9
- https://github.com/vrana/adminer/security/advisories/GHSA-h6jr-7pr6-grgj
- https://github.com/adminneo-org/adminneo/commit/2c86406808bc2517efb35f5595b3a05761c2eacd
- https://github.com/adminneo-org/adminneo/releases/tag/v5.5.1
- https://github.com/advisories/GHSA-rx7m-wxwq-vxr9
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-96632