Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 13

Export CSV
CVE-2026-0972

HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT

HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer Goanywhere Mft
CVE-2025-14362

GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances

The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer Goanywhere Mft
CVE-2025-1241

Encryption vulnerable to brute-force decryption in GoAnywhere MFT

Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Fortra Linux and 1 more
Products
Macos Goanywhere Agents Goanywhere Managed File Transfer and 3 more
CVE-2026-0971

GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout

An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer Goanywhere Mft
CVE-2026-1089

User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups

User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer Goanywhere Mft
CVE-2025-10035

Deserialization Vulnerability in GoAnywhere MFT's License Servlet

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

CVSS 3.1 · 10 Critical EPSS 99.8% KEV · Listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer
CVE-2025-8148

CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT

An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer
CVE-2023-0669

Fortra GoAnywhere MFT License Response Servlet Command Injection

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

CVSS 3.1 · 7.2 High EPSS 100.0% KEV · Listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer
CVE-2024-0204

Authentication Bypass in GoAnywhere MFT

Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.

CVSS 3.1 · 9.8 Critical EPSS 95.1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer
CVE-2024-11922

Input Validation vulnerability in Web Client emails that do not go through Secure Mail

Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or JavaScript into an email.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer
CVE-2025-0049

Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0

When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer
CVE-2024-25156

Path traversal in GoAnywhere MFT 7.4.1 and Earlier

A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer
CVE-2024-25157

Authentication bypass in GoAnywhere MFT prior to 7.6.0

An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer