CVE-2026-37066
Published · Updated
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.5epss 0.5%
from disclosure to weapon0 days
Published on NVDAug 27
1st PoCJun 15
exploitation probability
0.5%top 56% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests (POST and GET) to the affected endpoints.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · n/apublic PoCs found — 1
githubgithub.com/jfs-jfs/CVE-2026-37066★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.