Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
54 results · page 1 of 2
Mar 31, 2026Stored Cross-Site Scripting (XSS) in Teampass versions prior to 3.1.5.16, affecting the password manager's password import functionality at the endpoint 'redactCVE-2026-3107 · Other software · Teampass · reported by cve-coordination@incibe.esCritical 9.3
Stored Cross-Site Scripting (XSS) in Teampass versions prior to 3.1.5.16, affecting the password manager's password import functionality at the endpoint 'redacted/index.php?page=items'. The application fails to properly sanitize and encode user-input data during the import process, allowing malicious JavaScript payloads to be persistently stored in the database. When other users view the imported passwords, the payload is automatically executed in their browsers, resulting in a stored XSS condition at the endpoint 'redacted/index.php?page=items'. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code in the context of multiple users and the administrator, which can lead to session hijacking, credential theft, privilege abuse, and compromise of application integrity.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026Blind Cross-Site Scripting (XSS) in Teampass, versions prior to 3.1.5.16, within the password manager login functionality in the 'contraseña' parameter of the lCVE-2026-3106 · Other software · Teampass · reported by cve-coordination@incibe.esCritical 9.3
Blind Cross-Site Scripting (XSS) in Teampass, versions prior to 3.1.5.16, within the password manager login functionality in the 'contraseña' parameter of the login form 'redacted/index.php'. During failed authentication attempts, the application does not properly clean or encode the information entered by the user in the username field. As a result, arbitrary JavaScript code is automatically executed in the administrator's browser when viewing failed login entries, resulting in a blind XSS condition.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025A Cross Site Scripting (XSS) vulnerability exists in TeamPasswordManager v12.162.284 and before that could allow a remote attacker to execute arbitrary JavaScriCVE-2025-26091 · Other software · Teampasswordmanager · reported by MITREMedium 4.6
A Cross Site Scripting (XSS) vulnerability exists in TeamPasswordManager v12.162.284 and before that could allow a remote attacker to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'name' parameter when creating a new password in the "My Passwords" page.
- Product
- Team Password Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbrunocaseiro.github.io
Dec 30, 2024TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id.CVE-2024-50703 · Other software · TeamPass · reported by MITREMedium 5.4
TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id.
- Product
- TeamPass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2024TeamPass before 3.1.3.1 does not properly check whether a mail_me (aka action_mail) operation is on behalf of an administrator or manager.CVE-2024-50702 · Other software · TeamPass · reported by MITREMedium 5.4
TeamPass before 3.1.3.1 does not properly check whether a mail_me (aka action_mail) operation is on behalf of an administrator or manager.
- Product
- TeamPass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2024TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a user's allowed folders lCVE-2024-50701 · Other software · TeamPass · reported by MITREMedium 4.3
TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a user's allowed folders list that has been defined by an admin.
- Product
- TeamPass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10.CVE-2023-3565 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2023Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.CVE-2023-3553 · Other software · nilsteampassnet · reported by security@huntr.devHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2023Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10.CVE-2023-3552 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2023 Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.CVE-2023-3551 · Other software · nilsteampassnet · reported by security@huntr.devHigh 7.2
Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10.CVE-2023-3531 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3191 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2023Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3190 · Other software · nilsteampassnet · reported by security@huntr.devMedium 4.6
Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2023Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3095 · Other software · nilsteampassnet · reported by security@huntr.devMedium 6.5
Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3086 · Other software · nilsteampassnet · reported by security@huntr.devCritical 9
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3084 · Other software · nilsteampassnet · reported by security@huntr.devHigh 8.1
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3083 · Other software · nilsteampassnet · reported by security@huntr.devHigh 8.7
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-3009 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-2859 · Other software · nilsteampassnet · reported by security@huntr.devHigh 8.8
Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.CVE-2023-2591 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7.CVE-2023-2516 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2023Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.3.CVE-2023-2021 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.3.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.CVE-2023-1545 · Other software · nilsteampassnet · reported by security@huntr.devHigh 7.5
SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2023Authorization Bypass Through User-Controlled Key in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.CVE-2023-1463 · Other software · nilsteampassnet · reported by security@huntr.devMedium 5.4
Authorization Bypass Through User-Controlled Key in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22.CVE-2023-1070 · Other software · nilsteampassnet · reported by security@huntr.devHigh 7.1
External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22.
- Product
- nilsteampassnet/teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2022Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO.CVE-2022-26980 · Other software · Teampass · reported by MITREMedium 6.1
Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 19, 2021Team Password Manager (aka TeamPasswordManager) before 10.135.236 allows password-reset poisoning.CVE-2021-44037 · Other software · Teampasswordmanager · reported by MITREHigh 7.5
Team Password Manager (aka TeamPasswordManager) before 10.135.236 allows password-reset poisoning.
- Product
- Team Password Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordteampasswordmanager.comsyss.de
Nov 19, 2021Team Password Manager (aka TeamPasswordManager) before 10.135.236 has a CSRF vulnerability during import.CVE-2021-44036 · Other software · Teampasswordmanager · reported by MITREHigh 8.8
Team Password Manager (aka TeamPasswordManager) before 10.135.236 has a CSRF vulnerability during import.
- Product
- Team Password Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordteampasswordmanager.comsyss.de
May 4, 2020Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administCVE-2020-11671 · Other software · Teampass · reported by MITREHigh 8.1
Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2020TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php CVE-2020-12479 · Other software · Teampass · reported by MITREHigh 8.8
TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2020TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root.CVE-2020-12478 · Other software · Teampass · reported by MITREHigh 7.5
TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2020The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTCVE-2020-12477 · Other software · Teampass · reported by MITREHigh 7.5
The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2020Post-authentication Stored XSS in Team Password Manager through 7.93.204 allows attackers to steal other users' credentials by creating a shared password with HCVE-2019-19461 · Other software · Teampasswordmanager · reported by MITREMedium 5.4
Post-authentication Stored XSS in Team Password Manager through 7.93.204 allows attackers to steal other users' credentials by creating a shared password with HTML code as the title.
- Product
- Team Password Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordteampasswordmanager.compentagrid.ch
Oct 5, 2019TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt.CVE-2019-17205 · Other software · Teampass · reported by MITREMedium 6.1
TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2019TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item.CVE-2019-17204 · Other software · Teampass · reported by MITREMedium 5.4
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2019TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder.CVE-2019-17203 · Other software · Teampass · reported by MITREMedium 5.4
TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2019TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an admin.CVE-2019-16904 · Other software · Teampass · reported by MITREMedium 5.4
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an admin. (The crafted password is exploitable when viewing the change history of the item or tapping on the item.)
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2019An issue was discovered in TeamPass 2.1.27.35.CVE-2019-12950 · Other software · Teampass · reported by MITREMedium 5.4
An issue was discovered in TeamPass 2.1.27.35. From the sources/items.queries.php "Import items" feature, it is possible to load a crafted CSV file with an XSS payload.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2019TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared pCVE-2019-1000001 · Other software · Teampass · reported by MITRECritical 9.8
TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared passwords are recoverable server side. This attack appears to be exploitable via any vulnerability that can bypass authentication or role assignment and can lead to shared password leakage.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2017TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php.CVE-2017-15055 · Other software · Teampass · reported by MITREHigh 8.1
TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php. It is then possible to copy any arbitrary item into a directory controlled by the attacker, edit any item within a read-only directory, delete an arbitrary item, delete the file attachments of an arbitrary item, copy the password of an arbitrary item to the copy/paste buffer, access the history of an arbitrary item, and edit attributes of an arbitrary directory. To exploit the vulnerability, an authenticated attacker must tamper with the requests sent directly, for example by changing the "item_id" parameter when invoking "copy_item" on items.queries.php.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.amossys.frgithub.com
Nov 27, 2017An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files leading to Remote CommaCVE-2017-15054 · Other software · Teampass · reported by MITREHigh 7.5
An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files leading to Remote Command Execution. To exploit this vulnerability, an authenticated attacker has to tamper with parameters of a request to upload.files.php, in order to select the correct branch and be able to upload any arbitrary file. From there, it can simply access the file to execute code on the server.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.amossys.frgithub.com
Nov 27, 2017TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php.CVE-2017-15053 · Other software · Teampass · reported by MITREMedium 4.9
TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. It is then possible for a manager user to modify any arbitrary roles within the application, or delete any arbitrary role. To exploit the vulnerability, an authenticated attacker must have the manager rights on the application, then tamper with the requests sent directly, for example by changing the "id" parameter when invoking "delete_role" on roles.queries.php.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.amossys.frgithub.com
Nov 27, 2017TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php.CVE-2017-15052 · Other software · Teampass · reported by MITREMedium 4.9
TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete an arbitrary user (including admin), or modify attributes of any arbitrary user except administrator. To exploit the vulnerability, an authenticated attacker must have the manager rights on the application, then tamper with the requests sent directly, for example by changing the "id" parameter when invoking "delete_user" on users.queries.php.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.amossys.frgithub.com
Nov 27, 2017Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTCVE-2017-15051 · Other software · Teampass · reported by MITREMedium 5.4
Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTML via the (1) URL value of an item or (2) user log history. To exploit the vulnerability, the attacker must be first authenticated to the application. For the first one, the attacker has to simply inject XSS code within the URL field of a shared item. For the second one however, the attacker must prepare a payload within its profile, and then ask an administrator to modify its profile. From there, whenever the administrator accesses the log, it can be XSS'ed.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.amossys.frgithub.com
Oct 12, 2017Cross-Site Scripting (XSS) was discovered in TeamPass before 2.1.27.9.CVE-2017-15278 · Other software · Teampass · reported by MITREMedium 5.4
Cross-Site Scripting (XSS) was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data (in /sources/folders.queries.php). An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2017TeamPass before 2.1.27.4 is vulnerable to a SQL injection in users.queries.php.CVE-2017-9436 · Other software · Teampass · reported by MITRECritical 9.8
TeamPass before 2.1.27.4 is vulnerable to a SQL injection in users.queries.php.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2017Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an acCVE-2015-7564 · Other software · Teampass · reported by Red HatCritical 9.8
Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an action_on_quick_icon action to item.query.php or the (2) order or (3) direction parameter in an (a) connections_logs, (b) errors_logs or (c) access_logs action to view.query.php.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Apr 12, 2017Cross-site request forgery (CSRF) vulnerability in TeamPass 2.1.24 and earlier allows remote attackers to hijack the authentication of an authenticated user.CVE-2015-7563 · Other software · Teampass · reported by Red HatHigh 8.8
Cross-site request forgery (CSRF) vulnerability in TeamPass 2.1.24 and earlier allows remote attackers to hijack the authentication of an authenticated user.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Apr 12, 2017Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) labCVE-2015-7562 · Other software · Teampass · reported by Red HatMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) label value of an item or (2) name of a role.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Aug 7, 2014Multiple cross-site scripting (XSS) vulnerabilities in items.php in TeamPass before 2.1.20 allow remote attackers to inject arbitrary web script or HTML via theCVE-2014-3774 · Other software · Teampass · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in items.php in TeamPass before 2.1.20 allow remote attackers to inject arbitrary web script or HTML via the group parameter, which is not properly handled in a (1) hid_cat or (2) open_folder form element, or (3) id parameter, which is not properly handled in the open_id form element.
- Product
- Teampass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordteampass.netopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.