Gophish vulnerabilities

Products

• Gophish 7
• Admin Panel 3

Newest

• gophish Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site CVE-2026-107273 5.3 MediumOctober 7, 2026
• gophish Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages CVE-2026-107272 2.3 LowOctober 7, 2026
• gophish Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing CVE-2026-107271 6.9 MediumOctober 7, 2026
• gophish Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints CVE-2026-107270 7.1 HighOctober 7, 2026
• gophish Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy CVE-2026-107269 6.3 MediumOctober 7, 2026
• gophish Gophish Account Lockout and Forced Password Change Bypassable via API Key CVE-2026-82269 8.6 HighAugust 28, 2026
• gophish Gophish 0.12.1 Denial of Service via Office Document Upload CVE-2026-39904 7.1 HighJune 22, 2026
• getgophish gophish, gophish admin panel +1 more Cross-Site Scripting vulnerability in Gophish Admin Panel CVE-2024-2211 4.6 MediumMarch 6, 2024
• gophish admin panel, ween management panel +1 more SQLi in Weens Admin Panel CVE-2023-4541 9.8 CriticalDecember 29, 2023
• gophish admin panel, hedeftakip admin portal +1 more SQLi in Hedef Trackings Admin Panel CVE-2023-4737 9.8 CriticalSeptember 27, 2023