Loading vulnerability…
Veno File Manager Project 4.4.9 contains an incorrect access-control condition in an administrative log-export function. The function accepts a crafted POST request without requiring authentication and returns application logs beginning at an attacker-selected date.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a minimal proof-of-concept exploit for CVE-2026-37067 affecting Veno File Manager 4.4.9. It contains two files: a Bash exploit script (PoC.sh) and a short README describing the issue. The exploit is straightforward and operational: it accepts a starting date and a base URL, then sends an unauthenticated HTTP POST request to the VFM analytics CSV export endpoint with logsince set to the attacker-supplied date and loguntil hardcoded to 3000-12-31. If the target is vulnerable and logs exist for the requested period, the endpoint returns downloadable application logs without requiring authentication. The main capability is unauthorized disclosure of application logs, which may expose sensitive operational data. No shell, code execution, persistence, or lateral movement functionality is present. A notable detail is a path discrepancy between the README and the script: the README mentions /vfm-admin/admin-panel/view/save-cvs.php, while the actual exploit targets /vfm-admin/admin-panel/view/analytics/save-csv.php. The Bash script is the clear entry point and the only code file in the repository.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.