Gophish vulnerabilities
8 published CVEs name Gophish among the affected products.
- 8Published CVEs8 of them scored
- 7Last 12 monthspublished in the last year
- 0Critical3 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-107273
Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site
gophish · gophish
Medium5.3 - CVE-2026-107272
Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages
gophish · gophish
Low2.3 - CVE-2026-107271
Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing
gophish · gophish
Medium6.9 - CVE-2026-107270
Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints
gophish · gophish
High7.1 - CVE-2026-107269
Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy
gophish · gophish
Medium6.3 - CVE-2026-82269
Gophish Account Lockout and Forced Password Change Bypassable via API Key
gophish · gophish
High8.6 - CVE-2026-39904
Gophish 0.12.1 Denial of Service via Office Document Upload
gophish · gophish
High7.1 - CVE-2024-2211
Cross-Site Scripting vulnerability in Gophish Admin Panel
Gophish · Admin Panel
Medium4.6