Vendor
AdminNeo versions 4.6.0 through 5.5.0 contain a vulnerability where unsanitized X-Forwarded-Prefix headers allow cookie attribute injection, potentially leading to session hijacking and credential theft.