Getgophish Gophish
13 CVEs affecting Getgophish Gophish. Latest disclosed: 2026-02-06. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-24707 | High | 7.8 | 2020-10-28 | Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content. |
CVE-2025-70963 | High | 7.6 | 2026-02-06 | Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HT… |
CVE-2022-45003 | High | 7.5 | 2023-03-22 | Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus. |
CVE-2020-24713 | High | 7.5 | 2020-10-28 | Gophish through 0.10.1 does not invalidate the gophish cookie upon logout. |
CVE-2020-24711 | Medium | 6.5 | 2020-10-28 | The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack |
CVE-2022-45004 | Medium | 6.1 | 2023-03-22 | Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page. |
CVE-2022-25295 | Medium | 5.4 | 2022-09-11 | This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url… |
CVE-2020-24712 | Medium | 5.4 | 2020-10-28 | Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page. |
CVE-2020-24709 | Medium | 5.4 | 2020-10-28 | Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template. |
CVE-2020-24708 | Medium | 5.4 | 2020-10-28 | Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form. |
CVE-2020-24710 | Medium | 5.3 | 2020-10-28 | Gophish before 0.11.0 allows SSRF attacks. |
CVE-2019-16146 | Medium | 4.8 | 2019-09-09 | Gophish through 0.8.0 allows XSS via a username. |
CVE-2024-2211 | Medium | 4.6 | 2024-03-06 | Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. This vulnerability could allow an attacker to store a malicious JavaScript paylo… |