14 matches found
CVE-2026-37072
CVE-2026-37072 Veno File Manager Project Veno File Manager Project 4.4.9는 admin-head-updates.php에서 부적절한 접근 제어 취약점이 존재합니다. 인증되지 않은 공격자는 'lang' GET 파라미터의 로컬 파일 포함 취약점을 악용할 수 있습니다. 적절한 파일 포함이 포함된 특수하게 조작된 POST 요청을 'lang' URL 파라미터에 전송함으로써 공격자는 구성 파일을 손상시킬 수 있습니다. 그런 다음 setup 엔드포인트로 GET 요청을 전송하면 구성 파일...
CVE-2026-37072
Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...
CVE-2026-37072: Improper Access Control
Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...
CVE-2026-37072
Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...
CVE-2026-37072
Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...
CVE-2026-37072
The Veno File Manager Project version 4.4.9 is vulnerable to Incorrect Access Control in the admin-head-updates.php file. An unauthenticated attacker can exploit a Local File Inclusion (LFI) vulnerability via the lang GET parameter. By sending a specially crafted POST request with the correct fil...
EUVD-2026-67258
Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...
PT-2026-82675
Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...
CVE-2023-52257
LogoBee 0.2 allows updates.php?id= XSS...
CVE-2023-52257
LogoBee 0.2 allows updates.php?id= XSS...
Cross site scripting
LogoBee 0.2 allows updates.php?id= XSS...
CVE-2023-52257
CVE-2023-52257 affects LogoBee 0.2 with a cross‑site scripting vulnerability in the updates.php?id= endpoint. The root cause is unsafe handling of the id parameter, enabling injected scripts to run in the application's context. Impact: XSS that can affect users interacting with the update interfa...
