TeamPass stored cross-site scripting (XSS) vulnerability
Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTML via the (1) URL value of an item or (2) user log history. To exploit the vulnerability, the attacker must be first authenticated to the application. For the first one, the attacker has to simply inject XSS code within the URL field of a shared item. For the second one however, the attacker must prepare a payload within its profile, and then ask an administrator to modify its profile. From there, whenever the administrator accesses the log, it can be XSS'ed.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | nilsteampassnet/teampass | < 2.1.27.9 | 2.1.27.9 |
References
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-79- Platform
- Composer
- Package
nilsteampassnet/teampass- Disclosed
- 17.05.2022
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-r68m-4v39-cf43 - CC BY 4.0
Vulnerability history: nilsteampassnet/teampass
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 42
- First → latest
- 07.2021 12.2024
- Without a fix
- 11
- Exploited in attacks
- 0
Severity breakdown
- Critical 6
- High 15
- Medium 21
Disclosures per year
- 2021: 2
- 2022: 18
- 2023: 19
- 2024: 3
- 2025: 0
- 2026: 0
-
TeamPass stored cross-site scripting (XSS) vulnerability this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.