AdminNeo versions from 4.6.2 up to but not including 5.5.0 have a vulnerability in the `?script=version` endpoint that allows an attacker to cause a persistent denial of service. The endpoint accepts POST requests without origin or type validation, allowing an attacker to send a `version[]` parameter that PHP interprets as an array. This causes a type error in the server's cookie-setting function, resulting in HTTP 500 errors for all users for up to 24 hours until the cached version file expires or is deleted.