CVE-2020-24710

Gophish before 0.11.0 allows SSRF attacks.

CVE-2020-24708

Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.

CVE-2020-24707

Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.

CVE-2020-24709

Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.

CVE-2020-24711

The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack

CVE-2020-24713

Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.

CVE-2020-24712

Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.