Getgophish Gophish — known CVE vulnerabilities

Every CVE whose affected-product data names Getgophish Gophish, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (13)

CVE-2020-24707 — CVSS 7.8 (high): Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.
CVE-2025-70963 — CVSS 7.6 (high): Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly…
CVE-2020-24713 — CVSS 7.5 (high): Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.
CVE-2022-45003 — CVSS 7.5 (high): Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.
CVE-2020-24711 — CVSS 6.5 (medium): The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking…
CVE-2022-45004 — CVSS 6.1 (medium): Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.
CVE-2020-24712 — CVSS 5.4 (medium): Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.
CVE-2020-24708 — CVSS 5.4 (medium): Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.
CVE-2020-24709 — CVSS 5.4 (medium): Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.
CVE-2022-25295 — CVSS 5.4 (medium): This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The…
CVE-2020-24710 — CVSS 5.3 (medium): Gophish before 0.11.0 allows SSRF attacks.
CVE-2019-16146 — CVSS 4.8 (medium): Gophish through 0.8.0 allows XSS via a username.
CVE-2024-2211 — CVSS 4.6 (medium): Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. This vulnerability could allow an attacker to store a…