CVE-2026-37064: n/a

This vulnerability exists in Veno File Manager Project 4.4.9 at the /vfm-admin/ajax/usr-check.php endpoint. It allows an unauthenticated attacker to enumerate users by sending specially crafted POST requests with a 'user_name' parameter. The application responds differently based on whether the username exists, enabling the attacker to confirm valid usernames. The CVSS 3.1 base score is 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and limited confidentiality impact.

The impact is limited to information disclosure of valid usernames in the application. There is no direct impact on integrity or availability. This information could assist attackers in further targeted attacks such as password guessing or social engineering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or remediation level has been published. Until a patch is available, consider restricting access to the affected endpoint or implementing rate limiting to reduce the risk of automated enumeration.