CVE-2024-0204

CVE-2024-0204: Bypass dell'autenticazione in GoAnywhere MFT Script per creare un nuovo utente amministratore in GoAnywhere MFT. Articolo del blog Ulteriori dettagli qui: https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive Utilizzo La password deve essere...

fortra-goanywhere-mft-vulnerability-detection

Обнаружение уязвимостей Fortra GoAnywhere MFT Шаблоны Nuclei для обнаружения уязвимостей Fortra GoAnywhere MFT. Создано@rxerium Обзор Шаблоны обнаружения CVE для Fortra GoAnywhere Managed File Transfer MFT, включая несколько уязвимостей CISA KEV, эксплуатируемых группами программ-вымогателей...

CVE-2025-10035

CVE-2025-10035 — RCE da deserializzazione nel License Servlet di Fortra GoAnywhere MFT Rapporto di ricerca di Sentinel AI Defense. Solo analisi difensiva — nessun exploit funzionante o PoC viene pubblicato qui. Una catena di deserializzazione perfetta 10/10 in Fortra GoAnywhere MFT: una firma...

CVE-2025-10035

CVE-2025-10035 Come funziona questo metodo di rilevamento? Rileva istanze vulnerabili di GoAnywhere MFT estraendo i numeri di versione dalla pagina di login e confrontandoli con gli intervalli di versioni interessate. Come eseguo questo script? 1. Scarica Nuclei da qui 2. Copia il template sul tu...

CVE-2024-0204

CVE-2024-0204: Análise aprofundada da bypass de autenticação do Fortra GoAnywhere MFT Este repositório contém um proof-of-concept de exploit para a vulnerabilidade de bypass de autenticação CVE-2024-0204 descoberta no produto Fortra GoAnywhere MFT. A vulnerabilidade permite que um atacante não...

CVE-2023-0669

CVE-2023-0669 GoAnywhere MFT Deserializzazione - Blog di Je Yiuwai CVE-2023-0669 CVE-2023-0669 è una vulnerabilità di deserializzazione in GoAnywhere MFT. Esiste una vulnerabilità di injection di comandi pre-autenticata nel License Response Servlet a causa della deserializzazione di un oggetto...

CVE-2023-0669

CVE-2023-0669 GoAnywhere MFT soffre di una vulnerabilità di iniezione di comandi pre-autenticazione nel License Response Servlet a causa della deserializzazione di un oggetto arbitrario controllato dall'attaccante. 0x00 Dork shodan root@kitploit: title:"GoAnywhere" FOFA root@kitploit:...

CVE-2023-0669

CVE-2023-0669 CVE-2023-0669: vulnerabilità di iniezione di comandi in GoAnywhere MFT...

CVE-2025-10035

Scanner CVE-2025-10035 Visão Geral Este projeto fornece uma ferramenta para procurar sistemas potencialmente afetados pela CVE-2025-10035 , uma vulnerabilidade de desserialização no Servlet de Licença do Fortra GoAnywhere MFT. A vulnerabilidade pode permitir que um atacante com uma assinatura de...

CVE-2025-14362

The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force...

CVE-2026-1089

User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure...

CVE-2026-0971

An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page...

📄 GoAnywhere MFT 7.9.1 HTML Injection

GoAnywhere MFT versions prior to 7.10.0 are affected by an HTML injection vulnerability in the email templating functionality. If an attacker is able to influence the content of a template variable, malicious HTML can be embedded into outgoing emails generated by the application. As these message...

EUVD-2025-209540

The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force...

CVE-2025-14362

The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force...

CVE-2026-0972

HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing...

CVE-2026-1089 User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups

User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure...

CVE-2026-1089 User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups

User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure...

CVE-2026-0972 HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT

HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing...

CVE-2026-0972

CVE-2026-0972 concerns Fortra’s GoAnywhere MFT up to version 7.10.0. Connected sources document two concrete issues: 1) HTML injection in system-generated emails, and 2) the SFTP login limit is not enforced prior to 7.10.0 when a user logs in with an SSH key, potentially enabling brute-force key ...