TeamPass files are available without authentication

TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files...

TeamPass PHP arbitrary file include vulnerability

TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...

GHSA-V969-5V7F-PMG2 TeamPass Stored Cross-site Scripting

TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed...

TeamPass Stored Cross-site Scripting

TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed...

GHSA-QX37-225J-QR89 TeamPass Stored Cross-site Scripting

TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item...

GHSA-PQX8-Q35P-PGCV TeamPass Stored Cross-site Scripting

TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder...

TeamPass Stored Cross-site Scripting

TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder...

TeamPass Stored Cross-site Scripting

TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item...

GHSA-M3PP-JCPM-2VR9 TeamPass Cross-site Scripting (XSS)

An issue was discovered in TeamPass 2.1.27.35. From the sources/items.queries.php "Import items" feature, it is possible to load a crafted CSV file with an XSS payload...

TeamPass Cross-site Scripting (XSS)

An issue was discovered in TeamPass 2.1.27.35. From the sources/items.queries.php "Import items" feature, it is possible to load a crafted CSV file with an XSS payload...

SQL Injection

Overview nilsteampassnet/teampass is a password manager. Affected versions of this package are vulnerable to SQL Injection through the item.query.php or view.query.php endpoints. An attacker can manipulate the database and execute unauthorized SQL commands by injecting malicious SQL code into the...

GHSA-R64J-5W3W-FP49 TeamPass vulnerable to SQL Injection

Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in an actiononquickicon action to item.query.php or the 2 order or 3 direction parameter in an a connectionslogs, b errorslogs or c accesslogs acti...

TeamPass vulnerable to SQL Injection

Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in an actiononquickicon action to item.query.php or the 2 order or 3 direction parameter in an a connectionslogs, b errorslogs or c accesslogs acti...

Cross-site Scripting (XSS)

Overview nilsteampassnet/teampass is a password manager. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the label value of an item or name of a role. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious...

GHSA-48Q3-M4HF-56C9 TeamPass vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 label value of an item or 2 name of a role...

TeamPass vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 label value of an item or 2 name of a role...

GHSA-CM26-GP8J-W6XF TeamPass SQL injection in users.queries.php

TeamPass before 2.1.27.5 is vulnerable to a SQL injection in users.queries.php...

TeamPass SQL injection in users.queries.php

TeamPass before 2.1.27.5 is vulnerable to a SQL injection in users.queries.php...

GHSA-28PV-2J2H-FMHC TeamPass Cross-Site Scripting (XSS)

Cross-Site Scripting XSS was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data in /sources/folders.queries.php. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website...

TeamPass Cross-Site Scripting (XSS)

Cross-Site Scripting XSS was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data in /sources/folders.queries.php. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website...