Login Request a demo
GO
Product
Gophish
by Getgophish · last CVE Feb 6, 2026
13
CVEs
0
On KEV
7.8
Max CVSS
0
New 30D
Vulnerabilities13In the news0Timeline
Severity mix
Critical 0High 4Medium 9Low 0
Severity
All severities13Critical0High4Medium9Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Gophish to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-24707
7.8
1%
Oct 28
Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content
Affected: before 0.11.0
CVE-2025-70963
7.6
0%
Feb 6
Gophish <=0.12.1 is vulnerable to Incorrect Access Control
Affected: through 0.12.1
CVE-2022-45003
7.5
1%
Mar 22
Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus
Affected: through 0.12.1
CVE-2020-24713
7.5
1%
Oct 28
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout
Affected: through 0.10.1
CVE-2020-24711
6.5
2%
Oct 28
The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack
Affected: before 0.11.0
CVE-2024-2211
6.1
0%
Mar 6
Cross-Site Scripting vulnerability in Gophish Admin Panel
Affected: 0.12.1
CVE-2022-45004
6.1
1%
Mar 22
Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page
Affected: through 0.12.1
CVE-2022-25295
5.4
1%
Sep 11
Open Redirect
Affected: before 0.12.0
CVE-2020-24712
5.4
1%
Oct 28
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page
Affected: before 0.11.0
CVE-2020-24709
5.4
1%
Oct 28
Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template
Affected: through 0.10.1
CVE-2020-24708
5.4
1%
Oct 28
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form
Affected: before 0.11.0
CVE-2020-24710
5.3
1%
Oct 28
Gophish before 0.11.0 allows SSRF attacks
Affected: before 0.11.0
CVE-2019-16146
4.8
1%
Sep 9
Gophish through 0.8.0 allows XSS via a username
Affected: through 0.8.0
Showing 13