TeamPass before 2.1.27.4 is vulnerable to a SQL injection in users.queries.php.
Priority MEDIUM 44CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.
Summary
TeamPass before 2.1.27.4 is vulnerable to a SQL injection in users.queries.php.
Why it matters now
EPSS 0.01044 64th percentileScored 2026-11-07
Fix Fixed nilsteampassnet/teampass (Packagist): 2.1.27.5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | nilsteampassnet/teampass (Packagist) | before 2.1.27.5 | 2.1.27.5 | Patch available | GHSA-cm26-gp8j-w6xf |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- nilsteampassnet/teampass (Packagist) Vendor— Affected before 2.1.27.5 Fixed in 2.1.27.5 Patch available GHSA-cm26-gp8j-w6xf
CPE configurations NVD · 39
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:teampass:teampass:2.1.20.0:*:*:*:*:*:*:* | 2.1.20.0 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.22.0:*:*:*:*:*:*:* | 2.1.22.0 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.23.1:*:*:*:*:*:*:* | 2.1.23.1 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.23.2:*:*:*:*:*:*:* | 2.1.23.2 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.23.3:*:*:*:*:*:*:* | 2.1.23.3 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.23.4:*:*:*:*:*:*:* | 2.1.23.4 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.24.0:*:*:*:*:*:*:* | 2.1.24.0 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.24.1:*:*:*:*:*:*:* | 2.1.24.1 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.24.2:*:*:*:*:*:*:* | 2.1.24.2 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.24.3:*:*:*:*:*:*:* | 2.1.24.3 | Vulnerable | nilsteampassnet |
- cpe:2.3:a:teampass:teampass:2.1.20.0:*:*:*:*:*:*:* Versions 2.1.20.0 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.22.0:*:*:*:*:*:*:* Versions 2.1.22.0 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.23.1:*:*:*:*:*:*:* Versions 2.1.23.1 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.23.2:*:*:*:*:*:*:* Versions 2.1.23.2 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.23.3:*:*:*:*:*:*:* Versions 2.1.23.3 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.23.4:*:*:*:*:*:*:* Versions 2.1.23.4 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.24.0:*:*:*:*:*:*:* Versions 2.1.24.0 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.24.1:*:*:*:*:*:*:* Versions 2.1.24.1 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.24.2:*:*:*:*:*:*:* Versions 2.1.24.2 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.24.3:*:*:*:*:*:*:* Versions 2.1.24.3 Vulnerable ·nilsteampassnet
Show 29 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:teampass:teampass:2.1.24.4:*:*:*:*:*:*:* | 2.1.24.4 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.25.0:*:*:*:*:*:*:* | 2.1.25.0 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.25.1:*:*:*:*:*:*:* | 2.1.25.1 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.25.2:*:*:*:*:*:*:* | 2.1.25.2 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26:*:*:*:*:*:*:* | 2.1.26 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.0:*:*:*:*:*:*:* | 2.1.26.0 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.1:*:*:*:*:*:*:* | 2.1.26.1 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.2:*:*:*:*:*:*:* | 2.1.26.2 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.3:*:*:*:*:*:*:* | 2.1.26.3 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.4:*:*:*:*:*:*:* | 2.1.26.4 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.5:*:*:*:*:*:*:* | 2.1.26.5 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.6:*:*:*:*:*:*:* | 2.1.26.6 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.7:*:*:*:*:*:*:* | 2.1.26.7 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.8:*:*:*:*:*:*:* | 2.1.26.8 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.9:*:*:*:*:*:*:* | 2.1.26.9 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.10:*:*:*:*:*:*:* | 2.1.26.10 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.11:*:*:*:*:*:*:* | 2.1.26.11 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.12:*:*:*:*:*:*:* | 2.1.26.12 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.13:*:*:*:*:*:*:* | 2.1.26.13 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.14:*:*:*:*:*:*:* | 2.1.26.14 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.15:*:*:*:*:*:*:* | 2.1.26.15 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.16:*:*:*:*:*:*:* | 2.1.26.16 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.17:*:*:*:*:*:*:* | 2.1.26.17 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.18:*:*:*:*:*:*:* | 2.1.26.18 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.26.19:*:*:*:*:*:*:* | 2.1.26.19 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.27.0:*:*:*:*:*:*:* | 2.1.27.0 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.27.1:*:*:*:*:*:*:* | 2.1.27.1 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.27.2:*:*:*:*:*:*:* | 2.1.27.2 | Vulnerable | nilsteampassnet |
| cpe:2.3:a:teampass:teampass:2.1.27.3:*:*:*:*:*:*:* | 2.1.27.3 | Vulnerable | nilsteampassnet |
- cpe:2.3:a:teampass:teampass:2.1.24.4:*:*:*:*:*:*:* Versions 2.1.24.4 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.25.0:*:*:*:*:*:*:* Versions 2.1.25.0 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.25.1:*:*:*:*:*:*:* Versions 2.1.25.1 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.25.2:*:*:*:*:*:*:* Versions 2.1.25.2 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26:*:*:*:*:*:*:* Versions 2.1.26 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.0:*:*:*:*:*:*:* Versions 2.1.26.0 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.1:*:*:*:*:*:*:* Versions 2.1.26.1 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.2:*:*:*:*:*:*:* Versions 2.1.26.2 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.3:*:*:*:*:*:*:* Versions 2.1.26.3 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.4:*:*:*:*:*:*:* Versions 2.1.26.4 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.5:*:*:*:*:*:*:* Versions 2.1.26.5 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.6:*:*:*:*:*:*:* Versions 2.1.26.6 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.7:*:*:*:*:*:*:* Versions 2.1.26.7 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.8:*:*:*:*:*:*:* Versions 2.1.26.8 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.9:*:*:*:*:*:*:* Versions 2.1.26.9 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.10:*:*:*:*:*:*:* Versions 2.1.26.10 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.11:*:*:*:*:*:*:* Versions 2.1.26.11 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.12:*:*:*:*:*:*:* Versions 2.1.26.12 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.13:*:*:*:*:*:*:* Versions 2.1.26.13 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.14:*:*:*:*:*:*:* Versions 2.1.26.14 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.15:*:*:*:*:*:*:* Versions 2.1.26.15 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.16:*:*:*:*:*:*:* Versions 2.1.26.16 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.17:*:*:*:*:*:*:* Versions 2.1.26.17 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.18:*:*:*:*:*:*:* Versions 2.1.26.18 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.26.19:*:*:*:*:*:*:* Versions 2.1.26.19 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.27.0:*:*:*:*:*:*:* Versions 2.1.27.0 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.27.1:*:*:*:*:*:*:* Versions 2.1.27.1 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.27.2:*:*:*:*:*:*:* Versions 2.1.27.2 Vulnerable ·nilsteampassnet
- cpe:2.3:a:teampass:teampass:2.1.27.3:*:*:*:*:*:*:* Versions 2.1.27.3 Vulnerable ·nilsteampassnet
Remediation
- Fix · GHSA-cm26-gp8j-w6xf nilsteampassnet/teampass (Packagist) Fixed in 2.1.27.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-9436
- 2026-10-03 Alias added: GHSA-cm26-gp8j-w6xf
References
More nilsteampassnet Teampass vulnerabilities
- TI-2023-02892 Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass CVSS 3.1CRITICAL 9.0
- TI-2023-03315 Exposure of Sensitive Information to an Unauthorized Actor in nilsteampassnet/teampass CVSS 3.1HIGH 7.5
- TI-2023-01459 SQL Injection in nilsteampassnet/teampass CVSS 3.1HIGH 7.5
- TI-2023-02679 Code Injection in nilsteampassnet/teampass CVSS 3.1HIGH 8.8
- TI-2023-03313 Code Injection in nilsteampassnet/teampass CVSS 3.1HIGH 7.2
- TI-2023-01013 External Control of File Name or Path in nilsteampassnet/teampass CVSS 3.1HIGH 7.1
Sources
- CVE-2017-9436 · CVE Program
- CVE-2017-9436 · NVD
- FIRST EPSS
- GHSA-cm26-gp8j-w6xf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences