CVE-2026-37064

Veno File Manager Project 4.4.9 is vulnerable to user enumeration through the endpoint /vfm-admin/ajax/usr-check.php . An unauthenticated attacker can send a specially crafted POST request with a chosen user_name parameter to determine whether a given user exists in the application. This informat...