CVE-2026-3107 | Medium | 5.4 | 2026-03-31 | Stored Cross-Site Scripting (XSS) in Teampass versions prior to 3.1.5.16, affecting the password manager's password import functionality at the endpoint 'redac… |
CVE-2026-3106 | Medium | 5.4 | 2026-03-31 | Blind Cross-Site Scripting (XSS) in Teampass, versions prior to 3.1.5.16, within the password manager login functionality in the 'contraseña' parameter of the… |
CVE-2024-50703 | Medium | 5.4 | 2024-12-30 | TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id. |
CVE-2024-50702 | Medium | 5.4 | 2024-12-30 | TeamPass before 3.1.3.1 does not properly check whether a mail_me (aka action_mail) operation is on behalf of an administrator or manager. |
CVE-2024-50701 | Medium | 4.3 | 2024-12-30 | TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a user's allowed folders… |
CVE-2023-3565 | Medium | 5.4 | 2023-07-10 | Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10. |
CVE-2023-3553 | High | 7.5 | 2023-07-08 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10. |
CVE-2023-3552 | Medium | 5.4 | 2023-07-08 | Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10. |
CVE-2023-3551 | High | 7.2 | 2023-07-08 | Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10. |
CVE-2023-3531 | Medium | 5.4 | 2023-07-06 | Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10. |
CVE-2023-3191 | Medium | 5.4 | 2023-06-10 | Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-3190 | Medium | 4.6 | 2023-06-10 | Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-3095 | Medium | 6.5 | 2023-06-04 | Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-3086 | Critical | 9.0 | 2023-06-03 | Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-3084 | High | 8.1 | 2023-06-03 | Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-3083 | High | 8.7 | 2023-06-03 | Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-3009 | Medium | 5.4 | 2023-05-31 | Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-2859 | High | 8.8 | 2023-05-24 | Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-2591 | Medium | 5.4 | 2023-05-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7. |
CVE-2023-2516 | Medium | 5.4 | 2023-05-05 | Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7. |
CVE-2023-2021 | Medium | 5.4 | 2023-04-13 | Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.3. |
CVE-2023-1545 | High | 7.5 | 2023-03-21 | SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23. |
CVE-2023-1463 | Medium | 5.4 | 2023-03-17 | Authorization Bypass Through User-Controlled Key in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23. |
CVE-2023-1070 | High | 7.1 | 2023-02-27 | External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22. |
CVE-2022-26980 | Medium | 6.1 | 2022-03-28 | Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO. |
CVE-2020-11671 | High | 8.1 | 2020-05-04 | Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass adminis… |
CVE-2020-12479 | High | 8.8 | 2020-04-29 | TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php… |
CVE-2020-12478 | High | 7.5 | 2020-04-29 | TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files. |
CVE-2020-12477 | High | 7.5 | 2020-04-29 | The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HT… |
CVE-2019-17205 | Medium | 6.1 | 2019-10-05 | TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins… |
CVE-2019-17204 | Medium | 5.4 | 2019-10-05 | TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item. |
CVE-2019-17203 | Medium | 5.4 | 2019-10-05 | TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder. |
CVE-2019-16904 | Medium | 5.4 | 2019-09-26 | TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an admin. (The crafted pas… |
CVE-2019-12950 | Medium | 5.4 | 2019-08-06 | An issue was discovered in TeamPass 2.1.27.35. From the sources/items.queries.php "Import items" feature, it is possible to load a crafted CSV file with an XSS… |
CVE-2019-1000001 | Critical | 9.8 | 2019-02-04 | TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared… |
CVE-2017-15055 | High | 8.1 | 2017-11-27 | TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php. It is then possible to copy any arbitrary item into a… |
CVE-2017-15054 | High | 7.5 | 2017-11-27 | An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files leading to Remote Comm… |
CVE-2017-15053 | Medium | 4.9 | 2017-11-27 | TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. It is then possible for a manager user to modify a… |
CVE-2017-15052 | Medium | 4.9 | 2017-11-27 | TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete a… |
CVE-2017-15051 | Medium | 5.4 | 2017-11-27 | Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or H… |
CVE-2017-15278 | Medium | 5.4 | 2017-10-12 | Cross-Site Scripting (XSS) was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data (in /sources/folders.que… |
CVE-2017-9436 | Critical | 9.8 | 2017-06-05 | TeamPass before 2.1.27.4 is vulnerable to a SQL injection in users.queries.php. |
CVE-2015-7564 | Critical | 9.8 | 2017-04-12 | Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an a… |
CVE-2015-7563 | High | 8.8 | 2017-04-12 | Cross-site request forgery (CSRF) vulnerability in TeamPass 2.1.24 and earlier allows remote attackers to hijack the authentication of an authenticated user. |
CVE-2015-7562 | Medium | 6.1 | 2017-04-12 | Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) la… |
CVE-2014-3774 | | | 2014-08-07 | Multiple cross-site scripting (XSS) vulnerabilities in items.php in TeamPass before 2.1.20 allow remote attackers to inject arbitrary web script or HTML via th… |
CVE-2014-3773 | | | 2014-08-07 | Multiple SQL injection vulnerabilities in TeamPass before 2.1.20 allow remote attackers to execute arbitrary SQL commands via the login parameter in a (1) send… |
CVE-2014-3772 | | | 2014-08-07 | TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via a request to index.php followed by a direct request to a file that calls the s… |
CVE-2014-3771 | | | 2014-08-07 | TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via the language file path in a (1) request to index.php or (2) "change_user_langu… |
CVE-2012-2234 | | | 2012-04-22 | Cross-site scripting (XSS) vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticated users to inject arbitrary web script… |