CVE-2026-37064
UnknownSummary
The user enumeration vulnerability in Veno File Manager 4.4.9 allows an unauthenticated attacker to check if a given user exists in the application. By sending a specially crafted POST request with a chosen 'user_name' parameter, the attacker can confirm account existence.
Risk Assessment
User enumeration facilitates brute-force and phishing attacks because the attacker knows valid usernames, increasing the risk of unauthorized access.
Recommendation
Update Veno File Manager and implement mechanisms to limit server responses so that user existence is not disclosed.
Original NVD description (English source)
User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'user_name' parameter to test if the user exists.