Approved changes feed: RSS · Atom
cpe:2.3:a:getgophish:gophish:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Getgophish (c5429e6e-e17e-57df-a2d1-d9335e9bb08c) |
|---|---|
| Product | Gophish (4968fd07-e96c-5a74-8813-f26749d95ead) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/gophish/gophish |
purl2cpe | 2026-06-01 10:16:29.570756 |
pkg:github/gophish/gophish |
purl2cpe | 2026-06-01 10:16:29.570759 |
pkg:sourceforge/gophish.mirror |
purl2cpe | 2026-06-01 10:16:29.570762 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-70963 |
vulnerable | 2026-06-08 07:43:17.073312 |
Details available
Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.
Published: 2026-02-06T00:00:00.000Z
Updated: 2026-02-06T18:37:19.153Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-45004 |
vulnerable | 2026-06-08 05:50:35.071350 |
Details available
Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.
Published: 2023-03-22T00:00:00.000Z
Updated: 2025-02-26T16:21:31.053Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-45003 |
vulnerable | 2026-06-08 05:50:35.070703 |
Details available
Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.
Published: 2023-03-22T00:00:00.000Z
Updated: 2025-02-25T21:21:27.266Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25295 |
vulnerable | 2026-06-08 05:41:45.674567 |
Open Redirect
MEDIUM (5.4)
This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parse(r.FormValue("next")) to extract path and eventually redirect user to a relative URL, but if next parameter starts with multiple backslashes like \\\\\\example.com, browser will redirect user to http://example.com.
Published: 2022-09-11T13:45:20.564Z
Updated: 2024-09-16T17:29:06.682Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24713 |
vulnerable | 2026-06-08 05:22:35.382097 |
Details available
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.
Published: 2020-10-28T19:33:31.000Z
Updated: 2024-08-04T15:19:09.329Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24712 |
vulnerable | 2026-06-08 05:22:35.381827 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24711 |
vulnerable | 2026-06-08 05:22:35.381520 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24710 |
vulnerable | 2026-06-08 05:22:35.381189 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24709 |
vulnerable | 2026-06-08 05:22:35.380706 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24708 |
vulnerable | 2026-06-08 05:22:35.380229 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24707 |
vulnerable | 2026-06-08 05:22:35.379799 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-16146 |
vulnerable | 2026-06-08 05:13:07.787609 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.