Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (20 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-107273 1 Getgophish 1 Gophish 2026-10-07 4.3 Medium
Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service responses and enumerate internal hosts and ports through error messages.
CVE-2026-107272 1 Getgophish 1 Gophish 2026-10-07 4.7 Medium
Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view campaign results or send test emails, stealing API keys.
CVE-2026-107271 1 Getgophish 1 Gophish 2026-10-07 5.3 Medium
Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never triggers, enabling unlimited password guessing and credential stuffing.
CVE-2026-107270 1 Getgophish 1 Gophish 2026-10-07 7.1 High
Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/, /api/pages/ or /api/smtp/ to overwrite and reassign objects, locking out owners and exposing victims' recipient lists.
CVE-2026-107269 1 Getgophish 1 Gophish 2026-10-07 3.7 Low
Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing accounts, narrowing targets for password guessing or credential stuffing.
CVE-2026-82269 1 Getgophish 1 Gophish 2026-08-28 8.1 High
Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.
CVE-2026-39904 1 Getgophish 1 Gophish 2026-07-14 6.5 Medium
Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a crafted Office document as an email template attachment. The ApplyTemplate() function in models/attachment.go processes Office documents as ZIP archives and calls ioutil.ReadAll() on each contained file entry without enforcing size restrictions on uncompressed content, allowing a zip bomb payload to expand to several gigabytes in memory and cause the process to be terminated by the operating system.
CVE-2025-70963 1 Getgophish 1 Gophish 2026-02-10 7.6 High
Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.
CVE-2022-45004 1 Getgophish 1 Gophish 2025-02-26 6.1 Medium
Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.
CVE-2024-2211 1 Getgophish 1 Gophish 2025-02-26 4.6 Medium
Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. This vulnerability could allow an attacker to store a malicious JavaScript payload in the campaign menu and trigger the payload when the campaign is removed from the menu.
CVE-2022-45003 1 Getgophish 1 Gophish 2025-02-25 7.5 High
Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.
CVE-2022-25295 1 Getgophish 1 Gophish 2024-11-21 5.4 Medium
This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parse(r.FormValue("next")) to extract path and eventually redirect user to a relative URL, but if next parameter starts with multiple backslashes like \\\\\\example.com, browser will redirect user to http://example.com.
CVE-2020-24713 1 Getgophish 1 Gophish 2024-11-21 7.5 High
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.
CVE-2020-24712 1 Getgophish 1 Gophish 2024-11-21 5.4 Medium
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.
CVE-2020-24711 1 Getgophish 1 Gophish 2024-11-21 6.5 Medium
The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack
CVE-2020-24710 1 Getgophish 1 Gophish 2024-11-21 5.3 Medium
Gophish before 0.11.0 allows SSRF attacks.
CVE-2020-24709 1 Getgophish 1 Gophish 2024-11-21 5.4 Medium
Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.
CVE-2020-24708 1 Getgophish 1 Gophish 2024-11-21 5.4 Medium
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.
CVE-2020-24707 1 Getgophish 1 Gophish 2024-11-21 7.8 High
Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.
CVE-2019-16146 1 Getgophish 1 Gophish 2024-11-21 4.8 Medium
Gophish through 0.8.0 allows XSS via a username.