CVE-2026-37070

CVE-2026-37070 التحكم غير الصحيح في الوصول في /vfm-admin/ajax/streamvid.php في مشروع Veno File Manager الإصدار 4.4.9 يسمح لمهاجم مصرح له بقراءة أي ملفات مرفوعة من قبل مستخدمين آخرين طالما يعرف المسار واسم الملف عبر طلب GET مخصص للنقطة الطرفية المتأثرة...

CVE-2026-37070

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

CVE-2026-37070: Improper Access Control

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

CVE-2026-37066: Improper Limitation of a Pathname to a Restricted Directory

Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests POST and GET to the...

PT-2026-82673

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

CVE-2026-37070

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

CVE-2026-37070

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

CVE-2026-37070

The Veno File Manager Project version 4.4.9 is vulnerable to incorrect access control in the /vfm-admin/ajax/streamvid.php endpoint. This flaw allows an authenticated attacker to read any uploaded files belonging to other users by sending a specially crafted GET request while knowing the specific...

EUVD-2026-67260

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...