Getgophish 13 CVEs across 1 Getgophish products. Browse Getgophish vulnerabilities, severities, and proof-of-concept exploits.
Getgophish products with known CVEs Getgophish CVEs — newest first CVE Severity Score Published Summary CVE-2025-70963High 7.62026-02-06 Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HT… CVE-2024-2211Medium 4.62024-03-06 Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. This vulnerability could allow an attacker to store a malicious JavaScript paylo… CVE-2022-45004Medium 6.12023-03-22 Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page. CVE-2022-45003High 7.52023-03-22 Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus. CVE-2022-25295Medium 5.42022-09-11 This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url… CVE-2020-24713High 7.52020-10-28 Gophish through 0.10.1 does not invalidate the gophish cookie upon logout. CVE-2020-24712Medium 5.42020-10-28 Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page. CVE-2020-24711Medium 6.52020-10-28 The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack CVE-2020-24710Medium 5.32020-10-28 Gophish before 0.11.0 allows SSRF attacks. CVE-2020-24709Medium 5.42020-10-28 Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template. CVE-2020-24708Medium 5.42020-10-28 Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form. CVE-2020-24707High 7.82020-10-28 Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content. CVE-2019-16146Medium 4.82019-09-09 Gophish through 0.8.0 allows XSS via a username.