Priority MEDIUM 47
Stored Cross-Site Scripting (XSS) in Teampass versions prior to 3.1.5.16, affecting the password manager's password import functionality at the endpoint 'redacted/index.php?page=items'.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00139 · Published 2026-03-31 · Fixed in 3.1.5.24 CWE-79
Priority MEDIUM 47
Blind Cross-Site Scripting (XSS) in Teampass, versions prior to 3.1.5.16, within the password manager login functionality in the 'contraseña' parameter of the login form 'redacted/index.php'.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00159 · Published 2026-03-31 · No fix listed CWE-79
Priority LOW 36
TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00467 · Published 2024-12-30 · Fixed in 3.1.3.1 CWE-472
Priority LOW 24
TeamPass before 3.1.3.1 does not properly check whether a mail_me (aka action_mail) operation is on behalf of an administrator or manager.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00309 · Published 2024-12-30 · Fixed in 3.1.3.1 CWE-266
Priority LOW 20
TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a user's allowed folders list that has been defined by an admin.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00343 · Published 2024-12-30 · Fixed in 3.1.3.1 CWE-266
Priority MEDIUM 58
Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00625 · Published 2023-07-08 · Fixed in 3.0.10 CWE-79
Priority HIGH 72
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00828 · Published 2023-07-08 · Fixed in 3.0.10 CWE-200
Priority MEDIUM 58
Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00541 · Published 2023-07-08 · Fixed in 3.0.10 CWE-116
Priority HIGH 67
Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01137 · Published 2023-07-08 · Fixed in 3.0.10 CWE-94
Priority MEDIUM 60
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00537 · Published 2023-07-06 · Fixed in 3.0.10 CWE-79
Priority LOW 27
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00537 · Published 2023-06-10 · Fixed in 3.0.9 CWE-79
Priority MEDIUM 54
Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
CVSS 3.1MEDIUM 4.6· Network · Low privileges · User interaction · EPSS 0.00522 · Published 2023-06-10 · Fixed in 3.0.9 CWE-116
Priority MEDIUM 62
Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00381 · Published 2023-06-04 · Fixed in 3.0.9 CWE-284
Priority HIGH 74
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
CVSS 3.1CRITICAL 9.0· Network · Low privileges · User interaction · EPSS 0.00909 · Published 2023-06-03 · Fixed in 3.0.9 CWE-79
Priority LOW 39
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00841 · Published 2023-06-03 · Fixed in 3.0.9 CWE-79
Priority MEDIUM 41
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
CVSS 3.1HIGH 8.7· Network · Low privileges · User interaction · EPSS 0.00738 · Published 2023-06-03 · Fixed in 3.0.9 CWE-79
Priority LOW 28
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00683 · Published 2023-05-31 · Fixed in 3.0.9 CWE-79
Priority HIGH 71
Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01649 · Published 2023-05-24 · Fixed in 3.0.9 CWE-94
Priority MEDIUM 58
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00607 · Published 2023-05-09 · Fixed in 3.0.7 CWE-79
Priority MEDIUM 58
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00612 · Published 2023-05-05 · Fixed in 3.0.7 CWE-79
Priority MEDIUM 58
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.3.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00363 · Published 2023-04-13 · Fixed in 3.0.3 CWE-79
Priority HIGH 72
SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.08354 · Published 2023-03-21 · Fixed in 3.0.0.23, 3.0.0.22 CWE-89
Priority MEDIUM 58
Authorization Bypass Through User-Controlled Key in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00523 · Published 2023-03-17 · Fixed in 3.0.0.23 CWE-639
Priority MEDIUM 64
External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00823 · Published 2023-02-27 · Fixed in 3.0.0.22, 3.0.0.23 CWE-73
Priority LOW 29
Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01088 · Published 2022-03-28 · No fix listed CWE-79
Load more
THREATIST.IORead the docs