CVE-2026-37064

CVE-2026-37064 Veno File Manager Project 4.4.9의 /vfm-admin/ajax/usr-check.php에서 사용자 열거User enumeration 취약점이 발생합니다. 인증되지 않은 공격자는 선택한 'username' 매개변수를 사용하여 특수하게 조작된 POST 요청을 해당 엔드포인트에 전송함으로써 사용자 존재 여부를 테스트하여 애플리케이션 사용자를 열거할 수 있습니다...

CVE-2026-37064

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...

CVE-2026-37064

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...

CVE-2026-37064

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...

CVE-2026-37064

The Veno File Manager Project version 4.4.9 is vulnerable to user enumeration via the /vfm-admin/ajax/usr-check.php endpoint. An unauthenticated attacker can enumerate application users by sending a specially crafted POST request containing a chosen 'user_name' parameter to verify the existence o...

PT-2026-82667

Name of the Vulnerable Software and Affected Versions Veno File Manager Project version 4.4.9 Description An unauthenticated attacker can enumerate application users by sending a specially crafted POST request to the '/vfm-admin/ajax/usr-check.php' endpoint. By manipulating the user name paramete...

CVE-2026-37064: Observable Discrepancy

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...