Gophish vulnerable to Cross-site Scripting via crafted landing page

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-45004 · ADVISORY
• gophish/gophish · PACKAGE
• gophish/gophish release v0.12.1 · WEB
• pastebin.com/z5MD3z8c · WEB

More vulnerabilities in github.com/gophish/gophish

• CVE-2026-39904MEDIUM 6.5Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memor…
• CVE-2025-70963HIGH 7.6Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly ins…
• CVE-2024-55196HIGH 7.5Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords fo…
• CVE-2022-45003HIGH 7.5Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.
• CVE-2022-25295MEDIUM 5.4This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The a…