CVE-2023-2591

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in GitHub repository nilsteampassnet/teampass prior to 3.0.7...

CVE-2022-26980

Teampass 2.1.26 allows reflected XSS via the index.php PATHINFO...

CVE-2019-17204

TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item...

CVE-2019-17203

TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder...

CVE-2019-17205

TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed...

CVE-2019-16904

TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an admin. The crafted password is exploitable when viewing the change history of the item or tapping on the item...

CVE-2017-9436

TeamPass before 2.1.27.4 is vulnerable to a SQL injection in users.queries.php...

Exploit for SQL Injection in Teampass

CVE-2023-1545 Simple SQL Injection Python script for Teamp...

TeamPass 3.0.0.21 SQL Injection

TeamPass version 3.0.0.21 suffers from a remote SQL injection vulnerability. Exploit Title: TeamPass SQL Injection Google Dork: intitle:"Teampass" + inurl:index.php?page=items Date: 02/23/2025 Exploit Author: Max Meyer - Rivendell Vendor Homepage: http://www.teampass.net Software Link:...

TeamPass 3.0.0.21 - SQL Injection

Exploit Title: TeamPass SQL Injection Google Dork: intitle:"Teampass" + inurl:index.php?page=items Date: 02/23/2025 Exploit Author: Max Meyer - Rivendell Vendor Homepage: http://www.teampass.net Software Link: https://github.com/nilsteampassnet/TeamPass Version: 2.1.24 and prior Tested on:...

Exploit for SQL Injection in Teampass

Overview This contains a proof-of-concept script for CVE-...

Improper Access Control

nilsteampassnet/teampass is vulnerable to Improper access control. The vulnerability is due to the application failing to properly validate whether a folder belongs to the user's allowed folders list defined by an admin, allowing an attacker to bypass access restrictions and access unauthorized...

Improper Access Control

TeamPass is vulnerable to improper access control. The vulnerability is due to improper access control, as the application fails to verify whether a "mailmeaka actionmail" operation is performed by an administrator or manager, allowing an attacker to perform unauthorized operations...

Privilege Escalation

nilsteampassnet/teampass is vulnerable to Privilege Escalation. The vulnerability is due to improper access control in TeamPass, which fails to properly validate and restrict a user's actions based on their own privileges, allowing them to act with the privileges of a different userid...

Improper Authorization

Overview nilsteampassnet/teampass is a password manager. Affected versions of this package are vulnerable to Improper Authorization due to improper validation of user permissions in the items.queries.php component. An attacker can gain unauthorized access to folders by exploiting the lack of prop...

GHSA-2697-96MV-3GFM TeamPass does not properly check whether a folder is in a user's allowed folders list

TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a user's allowed folders list that has been defined by an admin...

GHSA-9WMC-988H-2MV2 TeamPass privileges issue

TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different userid...

Authorization Bypass Through User-Controlled Key

Overview nilsteampassnet/teampass is a password manager. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to improper handling of user session identifiers through the users.queries.php component. An attacker can escalate privileges and perfo...

Improper Authorization

Overview nilsteampassnet/teampass is a password manager. Affected versions of this package are vulnerable to Improper Authorization due to improper authorization checks in the mailme operation of the mailHandler function. An attacker can escalate privileges and perform actions reserved for...

TeamPass mail_me operation authorization issue

TeamPass before 3.1.3.1 does not properly check whether a mailme aka actionmail operation is on behalf of an administrator or manager...