The Default session expiration time
feature when submitted HTML/JS tags executes the code in the login page.
Login to Teampass and go to Settings
=> Options
. (http://127.0.0.1/index.php?page=options)
In theDefault session expiration time
input field insert an XSS payload "><svg/onload=alert(document.cookie)>
. Save the settings.
On a different browser, open the login page. The XSS payload executes.