CVE-2023-0669

CVE-2023-0669 CVE-2023-0669 ثغرة حقن الأوامر في GoAnywhere MFT...

CVE-2024-0204

CVE-2024-0204: تجاوز المصادقة في GoAnywhere MFT برنامج نصي لإنشاء مستخدم مسؤول جديد في GoAnywhere MFT. منشور المدونة المزيد من التفاصيل هنا: https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive الاستخدام يجب أن تكون كلمة المرور بطول 8 أحرف على الأقل لتلبية...

fortra-goanywhere-mft-vulnerability-detection

اكتشاف ثغرات Fortra GoAnywhere MFT قوالب Nuclei لاكتشاف ثغرات Fortra GoAnywhere MFT. أُنشئ بواسطة@rxerium نظرة عامة قوالب اكتشاف CVEs لـ Fortra GoAnywhere Managed File Transfer MFT، بما في ذلك ثغرات CISA KEV المتعددة التي تستغلها مجموعات برامج الفدية. الإحصائيات : 1 CVE 2021 + 1 CVE 2023 + 1 CVE...

CVE-2025-10035

ماسح CVE-2025-10035 نظرة عامة يوفر هذا المشروع أداة لفحص الأنظمة التي قد تتأثر بـ CVE-2025-10035 ، وهي ثغرة إلغاء تسلسل Deserialization في سيرفليت الترخيص License Servlet في GoAnywhere MFT من Fortra. قد تسمح هذه الثغرة لمهاجم يحمل توقيع استجابة ترخيص مزور بشكل صالح بإلغاء تسلسل كائنات عشوائية يتح...

CVE-2024-0204

CVE-2024-0204: استعراض معمّق لثغرة تجاوز المصادقة في Fortra GoAnywhere MFT يحتوي هذا المستودع على استغلال إثبات المفهوم لثغرة تجاوز المصادقة CVE-2024-0204 المكتشفة في منتج GoAnywhere MFT من Fortra. تسمح الثغرة لمهاجم غير مصادق بإنشاء مستخدم إداري للتطبيق. الوصف في 4 ديسمبر 2023، نشرت Fortra نشرة...

CVE-2025-10035

CVE-2025-10035 — Fortra GoAnywhere MFT : Désérialisation RCE du Servlet de Licence Analyse rédigée par Sentinel AI Defense. Analyse défensive uniquement — aucun exploit fonctionnel ni PoC n'est publié ici. Une chaîne de désérialisation parfaite de score 10 dans Fortra GoAnywhere MFT : une signatu...

CVE-2023-0669

CVE-2023-0669 GoAnywhere MFT पूर्व-प्रमाणीकरण कमांड इंजेक्शन भेद्यता से ग्रस्त है, जो लाइसेंस प्रतिक्रिया सर्वलेट में एक मनमाना हमलावर-नियंत्रित ऑब्जेक्ट को डिसीरियलाइज़ करने के कारण होता है। 0x00 डॉर्क shodan root@kitploit: title:"GoAnywhere" FOFA root@kitploit: title="GoAnywhere" 0x01 उपयोग Jav...

CVE-2023-0669

CVE-2023-0669 GoAnywhere MFT डिसेरियलाइज़ेशन - Je Yiuwai का ब्लॉग CVE-2023-0669 CVE-2023-0669 एक GoAnywhere MFT डिसेरियलाइज़ेशन भेद्यता है, जो लाइसेंस रिस्पॉन्स सर्वलेट में प्री-ऑथेंटिकेटेड कमांड इंजेक्शन भेद्यता के कारण उत्पन्न होती है, जिससे हमलावर हमलावर द्वारा नियंत्रित ऑब्जेक्ट को डिसेरियलाइ...

CVE-2025-10035

CVE-2025-10035 यह डिटेक्शन विधि कैसे काम करती है? लॉगिन पेज से संस्करण संख्याएँ निकालकर और प्रभावित संस्करण श्रेणियों से मिलान करके कमजोर GoAnywhere MFT इंस्टेंस का पता लगाता है। मैं इस स्क्रिप्ट को कैसे चलाऊँ? 1. Nuclei को यहाँ से डाउनलोड करें 2. टेम्पलेट को अपने स्थानीय सिस्टम पर कॉपी करें 3...

CVE-2025-14362

The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force...

CVE-2026-1089

User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure...

CVE-2026-0971

An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page...

📄 GoAnywhere MFT 7.9.1 HTML Injection

GoAnywhere MFT versions prior to 7.10.0 are affected by an HTML injection vulnerability in the email templating functionality. If an attacker is able to influence the content of a template variable, malicious HTML can be embedded into outgoing emails generated by the application. As these message...

EUVD-2025-209540

The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force...

CVE-2025-14362

The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force...

CVE-2026-0972

HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing...

CVE-2026-1089 User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups

User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure...

CVE-2026-1089 User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups

User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure...

CVE-2026-0972 HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT

HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing...

CVE-2026-0972 HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT

HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing...