CVE-2026-37065

Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion via the endpoint /vfm-admin/index.php?section=translations&action=update. The root cause is the unsanitized remove URL parameter, which allows an attacker to specify which file to delete. The vulnerability requires an authen...