Lucene search
K

7 matches found

SUSE CVE
SUSE CVE
added 2026/03/05 6:54 a.m.0 views

SUSE CVE-2025-70963

Gophish =0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user's long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context...

7.6CVSS5.8AI score0.00017EPSS
Exploits1References3
Github Security Blog
Github Security Blog
added 2026/02/06 6:30 p.m.4 views

Gophish is vulnerable to Incorrect Access Control

Gophish = 0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context...

7.6CVSS5.4AI score0.00017EPSS
Exploits1References3Affected Software1
NVD
NVD
added 2026/02/06 6:15 p.m.3 views

CVE-2025-70963

Gophish =0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context...

7.6CVSS0.00017EPSS
Exploits1References1
Vulnrichment
Vulnrichment
added 2026/02/06 12:0 a.m.3 views

CVE-2025-70963

Gophish =0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context...

5.4AI score0.00017EPSS
Exploits1References1
Positive Technologies
Positive Technologies
added 2026/02/06 12:0 a.m.3 views

PT-2026-6855

Gophish = 0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context...

8.5CVSS5.5AI score0.00017EPSS
Exploits1References4
EUVD
EUVD
added 2026/02/06 12:0 a.m.3 views

EUVD-2025-206883

Gophish =0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context...

7.6CVSS5.3AI score0.00017EPSS
Exploits1References1
Wiz blog
Wiz blog
added 2025/08/21 12:18 p.m.2 views

A new type of long-lived key on AWS: Bedrock API keys

New AWS Bedrock keys simplify authentication while raising security considerations...

7.6AI score
Exploits0
Rows per page
Query Builder