Vulnerabilidades em gophish
8 resultadosAnálise Vexday
GoPhish apresenta footprint de risco mínimo com apenas 1 CVE registrado e nenhuma exploração ativa documentada, embora a vulnerabilidade (CWE-770: alocação inadequada de recursos) tenha sido divulgada recentemente. O baixo volume e a ausência de atividade adversária sugerem risco contido, mas a natureza recente da exposição exige monitoramento contínuo.
CVE-2026-39904HIGHGophish 0.12.1 Denial of Service via Office Document UploadEPSS 0.4%CVE-2026-82269HIGHGophish Account Lockout and Forced Password Change Bypassable via API KeyEPSS 0.4%CVE-2024-2211MEDIUMCross-Site Scripting vulnerability in Gophish Admin PanelEPSS 0.3%CVE-2026-107271MEDIUMGophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For SpoofingEPSS —CVE-2026-107269MEDIUMGophish through 0.12.1 Username Enumeration via POST /login Timing DiscrepancyEPSS —CVE-2026-107270HIGHGophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create EndpointsEPSS —CVE-2026-107273MEDIUMGophish 0.11.0 through 0.12.1 SSRF via POST /api/import/siteEPSS —CVE-2026-107272LOWGophish through 0.12.1 XSS via Unescaped SMTP Server Error MessagesEPSS —