Getgophish maintains Gophish, a phishing simulation and awareness toolkit that occupies a niche in security training and red-team infrastructure. The vendor's vulnerability profile centers on web application and data-handling weaknesses endemic to credential-capture and campaign-tracking functionality: cross-site scripting, sensitive information exposure, CSV injection, clickjacking, and insecure credential storage recur across its disclosures, reflecting the inherent risks of a tool designed to collect and store user credentials and phishing artifacts. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Getgophish over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-24707HIGH Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content. | Oct 28, 2020 | 7.8 | 25 | NO | NO |
CVE-2025-70963HIGH Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the | Feb 6, 2026 | 7.6 | 24 | NO | NO |
CVE-2022-45003HIGH Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus. | Mar 22, 2023 | 7.5 | 24 | NO | NO |
CVE-2020-24713HIGH Gophish through 0.10.1 does not invalidate the gophish cookie upon logout. | Oct 28, 2020 | 7.5 | 24 | NO | NO |
CVE-2020-24711MEDIUM The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack | Oct 28, 2020 | 6.5 | 22 | NO | NO |
CVE-2022-25295MEDIUM This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parse(r.FormValue("n | Sep 11, 2022 | 5.4 | 21 | NO | NO |
CVE-2022-45004MEDIUM Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page. | Mar 22, 2023 | 6.1 | 20 | NO | NO |
CVE-2020-24710MEDIUM Gophish before 0.11.0 allows SSRF attacks. | Oct 28, 2020 | 5.3 | 20 | NO | NO |
CVE-2020-24712MEDIUM Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page. | Oct 28, 2020 | 5.4 | 19 | NO | NO |
CVE-2020-24709MEDIUM Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template. | Oct 28, 2020 | 5.4 | 19 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Getgophish.
Media articles that mention a CVE ID that affects a product developed by Getgophish — matched by CVE ID, not by vendor name.