CVE-2026-37066

The Veno File Manager Project 4.4.9 is vulnerable to a path traversal flaw within the /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php endpoints. This vulnerability allows an authenticated attacker with a super administrator role to perform an Arbitrary File Read , potentially disclosing se...

CVE-2026-37067

An incorrect access control vulnerability exists in the Veno File Manager Project 4.4.9 within the /vfm-admin/admin-panel/view/save-cvs.php component. This flaw allows an unauthenticated attacker to extract all application logs from a specific date onwards by sending a specially crafted POST requ...

CVE-2026-37068

The Veno File Manager Project 4.4.9 is vulnerable to an arbitrary file write flaw within the /vfm-admin/index.php?section=translations&action=update endpoint. This issue allows an authenticated user with super administrator privileges to overwrite any PHP file within the application by sending a ...

CVE-2026-37070

The Veno File Manager Project version 4.4.9 is vulnerable to incorrect access control in the /vfm-admin/ajax/streamvid.php endpoint. This flaw allows an authenticated attacker to read any uploaded files belonging to other users by sending a specially crafted GET request while knowing the specific...

CVE-2026-37073

An incorrect access control vulnerability exists in the Veno File Manager Project 4.4.9 at the /vfm-admin/ajax/sendfiles.php endpoint. This flaw allows an unauthenticated attacker to send emails from the application's configured SMTP server by making a POST request with the required parameters an...

CVE-2026-37069

The Veno File Manager Project version 4.4.9 is susceptible to an Absolute Path Disclosure vulnerability. An unauthenticated attacker can identify the system directory where the application code is running by sending a GET request to the /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath...

CVE-2026-37064

The Veno File Manager Project version 4.4.9 is vulnerable to user enumeration via the /vfm-admin/ajax/usr-check.php endpoint. An unauthenticated attacker can enumerate application users by sending a specially crafted POST request containing a chosen 'user_name' parameter to verify the existence o...

CVE-2026-37073

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...

CVE-2026-37068

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...

CVE-2026-37070

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

PT-2026-82673

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

PT-2026-82669

Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests POST and GET to the...

CVE-2026-37065

Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=...

PT-2026-82667

Name of the Vulnerable Software and Affected Versions Veno File Manager Project version 4.4.9 Description An unauthenticated attacker can enumerate application users by sending a specially crafted POST request to the '/vfm-admin/ajax/usr-check.php' endpoint. By manipulating the user name paramete...

CVE-2026-37067

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

EUVD-2026-67259

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming th...

EUVD-2026-67265

Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=...

CVE-2026-37067

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

PT-2026-82674

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming th...

CVE-2026-37071

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming th...