fortra-goanywhere-mft-vulnerability-detection

Detecção de Vulnerabilidades no Fortra GoAnywhere MFT Modelos do Nuclei para detecção de vulnerabilidades no Fortra GoAnywhere MFT. Criado por@rxerium Visão Geral Modelos de detecção de CVEs para o Fortra GoAnywhere Managed File Transfer MFT, incluindo múltiplas vulnerabilidades da CISA KEV...

CVE-2025-10035_GoAnywhere

GoAnywhere CVE-2025-10035 检查器 描述 一个轻量级的 Python 检查器 ，用于检测 GoAnywhere 实例是否存在 CVE‑2025‑10035 漏洞。 该工具发送一个精心构造的 GET 请求，使用随机化的 User-Agent（通过 fake-useragent 并附备用列表），不 跟随重定向，检查 Location 标头，并将实例分类为 未修补（存在漏洞） 或 已修补（不存在漏洞） 。 注意：此仓库目前仅包含检查器 。PoC（概念验证代码）可能会在后续适当的时候，单独放在一个明确标记的位置添加 —— 目前该项目仅用于检测。 漏洞概述...

CVE-2025-10035

CVE-2025-10035 Как работает этот метод обнаружения? Обнаруживает уязвимые экземпляры GoAnywhere MFT путем извлечения номеров версий со страницы входа и сопоставления с диапазонами затронутых версий. Как запустить этот скрипт? 1. Скачайте Nuclei отсюда 2. Скопируйте шаблон в свою локальную систему...

CVE-2023-0669-Analysis

CVE-2023-0669 Ce dépôt contient les paquets et scripts utilisés dans cette analyse https://www.vicarius.io/vsociety/blog/unauthenticated-rce-in-goanywhere La version vulnérable de GoAnywhere pour Linux https://www.dropbox.com/s/j31l8lgvapbopy3/ga703linuxx64.sh?dl=0...

CVE-2024-0204

CVE-2024-0204: Bypass de Autenticação no GoAnywhere MFT Script para criar um novo usuário administrador no GoAnywhere MFT. Postagem do Blog Mais detalhes aqui: https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive Uso A senha deve ter pelo menos 8 caracteres...

CVE-2025-10035

CVE-2025-10035 — Fortra GoAnywhere MFT : Désérialisation RCE du Servlet de Licence Analyse rédigée par Sentinel AI Defense. Analyse défensive uniquement — aucun exploit fonctionnel ni PoC n'est publié ici. Une chaîne de désérialisation parfaite de score 10 dans Fortra GoAnywhere MFT : une signatu...

CVE-2024-0204

CVE-2024-0204: Fortra GoAnywhere MFT प्रमाणीकरण बाईपास गहराई से जांच इस रिपॉजिटरी में Fortra के GoAnywhere MFT उत्पाद में खोजी गई प्रमाणीकरण बाईपास भेद्यता CVE-2024-0204 के लिए एक प्रूफ-ऑफ-कॉन्सेप्ट एक्सप्लॉइट शामिल है। यह भेद्यता एक अप्रमाणित हमलावर को एप्लिकेशन के लिए एक प्रशासनिक उपयोगकर्ता...

CVE-2023-0669

CVE-2023-0669 GoAnywhere MFT Deserializzazione - Blog di Je Yiuwai CVE-2023-0669 CVE-2023-0669 è una vulnerabilità di deserializzazione in GoAnywhere MFT. Esiste una vulnerabilità di injection di comandi pre-autenticata nel License Response Servlet a causa della deserializzazione di un oggetto...

CVE-2023-0669

CVE-2023-0669 GoAnywhere MFT soffre di una vulnerabilità di iniezione di comandi pre-autenticazione nel License Response Servlet a causa della deserializzazione di un oggetto arbitrario controllato dall'attaccante. 0x00 Dork shodan root@kitploit: title:"GoAnywhere" FOFA root@kitploit:...

CVE-2023-0669

CVE-2023-0669 CVE-2023-0669: vulnerabilità di iniezione di comandi in GoAnywhere MFT...

CVE-2025-10035

Scanner CVE-2025-10035 Visão Geral Este projeto fornece uma ferramenta para procurar sistemas potencialmente afetados pela CVE-2025-10035 , uma vulnerabilidade de desserialização no Servlet de Licença do Fortra GoAnywhere MFT. A vulnerabilidade pode permitir que um atacante com uma assinatura de...

Fortra GoAnywhere MFT - Remote Code Execution

Fortra GoAnywhere MFT is susceptible to remote code execution via unsafe deserialization of an arbitrary attacker-controlled object. This stems from a pre-authentication command injection vulnerability in the License Response Servlet. id: CVE-2023-0669 info: name: Fortra GoAnywhere MFT - Remote...

CVE-2025-1241

Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data...

CVE-2025-14362

The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force...

CVE-2026-1089

User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure...

CVE-2026-0971

An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page...

📄 GoAnywhere MFT 7.9.1 HTML Injection

GoAnywhere MFT versions prior to 7.10.0 are affected by an HTML injection vulnerability in the email templating functionality. If an attacker is able to influence the content of a template variable, malicious HTML can be embedded into outgoing emails generated by the application. As these message...

CVE-2026-0972

HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing...

EUVD-2026-24129

The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force...

EUVD-2025-209539

Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data...