Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Oct 7, 2026Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private CVE-2026-107273 · Other software · gophish · reported by VulnCheckMedium 5.3
Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service responses and enumerate internal hosts and ports through error messages.
- Product
- gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.ostorlab.cogithub.com
Oct 7, 2026Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP servCVE-2026-107272 · Other software · gophish · reported by VulnCheckLow 2.3
Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view campaign results or send test emails, stealing API keys.
- Product
- gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.ostorlab.cogithub.com
Oct 7, 2026Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For oCVE-2026-107271 · Other software · gophish · reported by VulnCheckMedium 6.9
Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never triggers, enabling unlimited password guessing and credential stuffing.
- Product
- gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.ostorlab.cogithub.com
Oct 7, 2026Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, lCVE-2026-107270 · Other software · gophish · reported by VulnCheckHigh 7.1
Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/, /api/pages/ or /api/smtp/ to overwrite and reassign objects, locking out owners and exposing victims' recipient lists.
- Product
- gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.ostorlab.cogithub.com
Oct 7, 2026Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by meCVE-2026-107269 · Other software · gophish · reported by VulnCheckMedium 6.3
Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing accounts, narrowing targets for password guessing or credential stuffing.
- Product
- gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.ostorlab.cogithub.com
Aug 28, 2026Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware.CVE-2026-82269 · Other software · gophish · reported by VulnCheckHigh 8.6
Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.
- Product
- gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a craCVE-2026-39904 · Other software · gophish · reported by VulnCheckHigh 7.1
Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a crafted Office document as an email template attachment. The ApplyTemplate() function in models/attachment.go processes Office documents as ZIP archives and calls ioutil.ReadAll() on each contained file entry without enforcing size restrictions on uncompressed content, allowing a zip bomb payload to expand to several gigabytes in memory and cause the process to be terminated by the operating system.
- Product
- gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Feb 6, 2026Gophish <=0.12.1 is vulnerable to Incorrect Access Control.CVE-2025-70963 · Other software · Getgophish · reported by MITREHigh 7.6
Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.
- Product
- Gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMACVE-2024-55196 · Other software · reported by MITREHigh 7.5
Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1.CVE-2024-2211 · Other software · Gophish · reported by cve-coordination@incibe.esMedium 4.6
Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. This vulnerability could allow an attacker to store a malicious JavaScript payload in the campaign menu and trigger the payload when the campaign is removed from the menu.
- Product
- Admin Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.CVE-2022-45004 · Other software · Getgophish · reported by MITREMedium 6.1
Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.
- Product
- Gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compastebin.com
Mar 22, 2023Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.CVE-2022-45003 · Other software · Getgophish · reported by MITREHigh 7.5
Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.
- Product
- Gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compastebin.com
Sep 11, 2022This affects the package github.com/gophish/gophish before 0.12.0.CVE-2022-25295 · Other software · Getgophish · reported by report@snyk.ioMedium 5.4
This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parse(r.FormValue("next")) to extract path and eventually redirect user to a relative URL, but if next parameter starts with multiple backslashes like \\\\\\example.com, browser will redirect user to http://example.com.
- Product
- Gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Oct 28, 2020Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.CVE-2020-24713 · Other software · Getgophish · reported by MITREHigh 7.5
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.
- Product
- Gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Oct 28, 2020Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.CVE-2020-24712 · Other software · Getgophish · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.
- Product
- Gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2020The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attackCVE-2020-24711 · Other software · Getgophish · reported by MITREMedium 6.5
The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack
- Product
- Gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2020Gophish before 0.11.0 allows SSRF attacks.CVE-2020-24710 · Other software · Getgophish · reported by MITREMedium 5.3
Gophish before 0.11.0 allows SSRF attacks.
- Product
- Gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2020Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.CVE-2020-24709 · Other software · Getgophish · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.
- Product
- Gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Oct 28, 2020Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.CVE-2020-24708 · Other software · Getgophish · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.
- Product
- Gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comherolab.usd.de
Oct 28, 2020Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.CVE-2020-24707 · Other software · Getgophish · reported by MITREHigh 7.8
Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.
- Product
- Gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2019Gophish through 0.8.0 allows XSS via a username.CVE-2019-16146 · Other software · Getgophish · reported by MITREMedium 4.8
Gophish through 0.8.0 allows XSS via a username.
- Product
- Gophish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.