Getgophish vulnerabilities
13 vulnerabilities
Known vulnerabilities in Getgophish products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
Products
1- Gophish13 vulnerabilities
PrioritiseCVE-2025-70963getgophish · gophish +1 moregetgophish gophishGophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.CVSS7.6HighEPSS0.30%RoutineCVE-2024-2211gophish · admin panel +1 moreCross-Site Scripting vulnerability in Gophish Admin PanelCross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. This vulnerability could allow an attacker to store a malicious JavaScript payload in the campaign menu and trigger the payload when the campaign is removed from the menu.CVSS6.1MediumEPSS0.29%RoutineCVE-2022-45004getgophish · gophish +1 moregetgophish gophishGophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.CVSS6.1MediumEPSS0.60%PrioritiseCVE-2022-45003getgophish · gophish +1 moregetgophish gophishGophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.CVSS7.5HighEPSS1.04%RoutineCVE-2022-25295getgophish · gophish +1 moreOpen RedirectThis affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parse(r.FormValue("next")) to extract path and eventually redirect user to a relative URL, but if next parameter starts with multiple backslashes like \\\\\\example.com, browser will redirect user to http://example.com.CVSS5.4MediumEPSS0.69%PrioritiseCVE-2020-24707getgophish · gophishgetgophish gophishGophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.CVSS9.3CriticalEPSS1.33%PrioritiseCVE-2020-24713getgophish · gophishgetgophish gophishGophish through 0.10.1 does not invalidate the gophish cookie upon logout.CVSS7.5HighEPSS1.16%RoutineCVE-2020-24711getgophish · gophishgetgophish gophishThe Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attackCVSS6.5MediumEPSS1.56%RoutineCVE-2020-24710getgophish · gophish +1 moregetgophish gophishGophish before 0.11.0 allows SSRF attacks.CVSS5.3MediumEPSS1.34%RoutineCVE-2020-24712getgophish · gophishgetgophish gophishCross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.CVSS5.4MediumEPSS0.86%RoutineCVE-2020-24709getgophish · gophishgetgophish gophishCross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.CVSS5.4MediumEPSS0.56%RoutineCVE-2020-24708getgophish · gophishgetgophish gophishCross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.CVSS5.4MediumEPSS0.63%RoutineCVE-2019-16146getgophish · gophish +1 moregetgophish gophishGophish through 0.8.0 allows XSS via a username.CVSS4.8MediumEPSS0.66%