EUVD-2026-67264

Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests POST and GET to the...

EUVD-2026-67258

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...

CVE-2026-37066: Improper Limitation of a Pathname to a Restricted Directory

Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests POST and GET to the...

CVE-2026-37065

Veno File Manager Project version 4.4.9 is vulnerable to Arbitrary File Deletion . An authenticated attacker with superadmin privileges can execute a specially crafted POST request to the /vfm-admin/index.php?section=translations&action=update&remove= endpoint. By manipulating the remove URL para...

EUVD-2026-67263

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

CVE-2026-37067

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

CVE-2026-37069: Exposure of Sensitive Information to an Unauthorized Actor

Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...

EUVD-2026-67261

Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...

CVE-2026-37073: Improper Access Control

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...

CVE-2026-37073

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...

CVE-2026-37073

An incorrect access control vulnerability exists in the Veno File Manager Project 4.4.9 at the /vfm-admin/ajax/sendfiles.php endpoint. This flaw allows an unauthenticated attacker to send emails from the application's configured SMTP server by making a POST request with the required parameters an...

CVE-2026-37068

The Veno File Manager Project 4.4.9 is vulnerable to an arbitrary file write flaw within the /vfm-admin/index.php?section=translations&action=update endpoint. This issue allows an authenticated user with super administrator privileges to overwrite any PHP file within the application by sending a ...

CVE-2026-37072

The Veno File Manager Project version 4.4.9 is vulnerable to Incorrect Access Control in the admin-head-updates.php file. An unauthenticated attacker can exploit a Local File Inclusion (LFI) vulnerability via the lang GET parameter. By sending a specially crafted POST request with the correct fil...

EUVD-2026-67257

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...

PT-2026-82671

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...

CVE-2026-37071

The Veno File Manager Project 4.4.9 is vulnerable to an arbitrary file rename flaw within the Actions::renameFile() function. An authenticated attacker possessing 'reanme' permission can exploit this by sending a specially crafted POST request to the affected endpoint. This allows the attacker to...

PT-2026-82668

Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=...

EUVD-2026-67259

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming th...

PT-2026-82675

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...

CVE-2026-37069

Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...