CVE-2025-70963

<= 0.12.1

Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key

7.6HIGH

CVE-2024-2211

all versions

Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. This vulnerability could allow an attacker to store

4.6MEDIUM

CVE-2022-45004

<= 0.12.1

Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.

6.1MEDIUM

CVE-2022-45003

<= 0.12.1

Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.

7.5HIGH

CVE-2022-25295

< 0.12.0

This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parame

5.4MEDIUM

CVE-2020-24713

<= 0.10.1

Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.

7.5HIGH

CVE-2020-24712

< 0.11.0

Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.

5.4MEDIUM

CVE-2020-24711

< 0.11.0

The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickja

6.5MEDIUM

CVE-2020-24710

< 0.11.0

Gophish before 0.11.0 allows SSRF attacks.

5.3MEDIUM

CVE-2020-24709

<= 0.10.1

Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.

5.4MEDIUM

CVE-2020-24708

< 0.11.0

Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.

5.4MEDIUM

CVE-2020-24707

< 0.11.0

Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.

7.8HIGH

CVE-2019-16146

<= 0.8.0

Gophish through 0.8.0 allows XSS via a username.

4.8MEDIUM