Gophish vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20267

Newest CVEs

• CVE-2026-107273

  Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site

  gophish · gophish

  Medium5.3
• CVE-2026-107272

  Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages

  gophish · gophish

  Low2.3
• CVE-2026-107271

  Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing

  gophish · gophish

  Medium6.9
• CVE-2026-107270

  Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints

  gophish · gophish

  High7.1
• CVE-2026-107269

  Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy

  gophish · gophish

  Medium6.3
• CVE-2026-82269

  Gophish Account Lockout and Forced Password Change Bypassable via API Key

  gophish · gophish

  High8.6
• CVE-2026-39904

  Gophish 0.12.1 Denial of Service via Office Document Upload

  gophish · gophish

  High7.1
• CVE-2024-2211

  Cross-Site Scripting vulnerability in Gophish Admin Panel

  Gophish · Admin Panel

  Medium4.6