CVE-2026-107272 — Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages
Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages…
Published: 2026-10-07 · CVSS: 2.3 · CVSS 4.0
Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view campaign results or send test emails, stealing API keys.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7