Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
Getgophish records in CISA KEVNo Getgophish vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsPriority HIGH 72
Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01036 · Published 2023-03-22 · No fix listed CWE-400
Priority HIGH 66
Gophish <=0.12.1 is vulnerable to Incorrect Access Control.
CVSS 3.1HIGH 7.6· Network · Low privileges · User interaction · EPSS 0.00304 · Published 2026-02-06 · No fix listed CWE-200
Priority MEDIUM 60
Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00595 · Published 2023-03-22 · No fix listed CWE-79
Priority LOW 37
Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.01329 · Published 2020-10-28 · No fix listed CWE-1236
Priority LOW 35
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01156 · Published 2020-10-28 · No fix listed CWE-613
Priority LOW 32
The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01564 · Published 2020-10-28 · No fix listed CWE-1021
Priority LOW 27
Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00292 · Published 2024-03-06 · No fix listed CWE-79
Priority LOW 27
Gophish before 0.11.0 allows SSRF attacks.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01338 · Published 2020-10-28 · Fixed in 0.11.0 CWE-918
Priority LOW 26
This affects the package github.com/gophish/gophish before 0.12.0.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00702 · Published 2022-09-11 · Fixed in 0.12.0 CWE-601
Priority LOW 26
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00862 · Published 2020-10-28 · No fix listed CWE-79
Priority LOW 25
Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00557 · Published 2020-10-28 · No fix listed CWE-79
Priority LOW 25
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00625 · Published 2020-10-28 · No fix listed CWE-79
Priority LOW 23
Gophish through 0.8.0 allows XSS via a username.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00657 · Published 2019-09-09 · Fixed in 0.9.0 CWE-79
THREATIST.IORead the docs