# nilsteampassnet/teampass (Packagist) vulnerabilities 42 known vulnerabilities (2 critical, 9 high, 10 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/nilsteampassnet/teampass ## Advisories (42) ### [CVE-2024-50703](https://cve.now/CVE-2024-50703): TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user\_id. - Severity: Medium 5.4 - Published: Dec 30, 2024 - Affected: fixed in 3.1.3.1. ### [CVE-2024-50702](https://cve.now/CVE-2024-50702): TeamPass before 3.1.3.1 does not properly check whether a mail\_me (aka action\_mail) operation is on behalf of an administrator or manager. - Severity: Medium 5.4 - Published: Dec 30, 2024 - Affected: fixed in 3.1.3.1. ### [CVE-2024-50701](https://cve.now/CVE-2024-50701): TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a… - Severity: Medium 4.3 - Published: Dec 30, 2024 - Affected: fixed in 3.1.3.1. ### [CVE-2023-3565](https://cve.now/CVE-2023-3565): Cross-site Scripting (XSS) - Generic in nilsteampassnet/teampass - Severity: Medium 5.2 - Published: Jul 8, 2023 - Affected: fixed in 3.0.10. ### [CVE-2023-3553](https://cve.now/CVE-2023-3553): Exposure of Sensitive Information to an Unauthorized Actor in nilsteampassnet/teampass - Severity: Medium 5.3 - Published: Jul 8, 2023 - Affected: fixed in 3.0.10. ### [CVE-2023-3552](https://cve.now/CVE-2023-3552): Improper Encoding or Escaping of Output in nilsteampassnet/teampass - Severity: High 7.6 - Published: Jul 8, 2023 - Affected: fixed in 3.0.10. ### [CVE-2023-3551](https://cve.now/CVE-2023-3551): Code Injection in nilsteampassnet/teampass - Severity: Critical 9.1 - Published: Jul 8, 2023 - Affected: fixed in 3.0.10. ### [CVE-2023-3531](https://cve.now/CVE-2023-3531): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass - Severity: High 8.1 - Published: Jul 6, 2023 - Affected: fixed in 3.0.10. ### [CVE-2023-3191](https://cve.now/CVE-2023-3191): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass - Severity: High 8.1 - Published: Jun 10, 2023 - Affected: fixed in 3.0.9. ### [CVE-2023-3190](https://cve.now/CVE-2023-3190): Improper Encoding or Escaping of Output in nilsteampassnet/teampass - Severity: Low 3.5 - Published: Jun 10, 2023 - Affected: fixed in 3.0.9. ### [CVE-2023-3095](https://cve.now/CVE-2023-3095): Improper Access Control in nilsteampassnet/teampass - Severity: Medium 6.2 - Published: Jun 4, 2023 - Affected: fixed in 3.0.9. ### [CVE-2023-3086](https://cve.now/CVE-2023-3086): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass - Severity: Critical 9.0 - Published: Jun 3, 2023 - Affected: fixed in 3.0.9. ### [CVE-2023-3084](https://cve.now/CVE-2023-3084): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass - Severity: High 8.1 - Published: Jun 3, 2023 - Affected: fixed in 3.0.9. ### [CVE-2023-3083](https://cve.now/CVE-2023-3083): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass - Severity: Medium 6.1 - Published: Jun 3, 2023 - Affected: fixed in 3.0.9. ### [CVE-2023-3009](https://cve.now/CVE-2023-3009): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass - Severity: High 8.1 - Published: May 31, 2023 - Affected: fixed in 3.0.9. ### [CVE-2023-2859](https://cve.now/CVE-2023-2859): Code Injection in nilsteampassnet/teampass - Severity: High 7.1 - Published: May 24, 2023 - Affected: fixed in 3.0.9. ### [CVE-2023-2591](https://cve.now/CVE-2023-2591): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nilsteampassnet/teampass - Severity: High 7.1 - Published: May 9, 2023 - Affected: fixed in 3.0.7. ### [CVE-2023-2516](https://cve.now/CVE-2023-2516): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass - Severity: Medium 5.4 - Published: May 5, 2023 - Affected: fixed in 3.0.7. ### [CVE-2023-2021](https://cve.now/CVE-2023-2021): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass - Severity: Medium 5.8 - Published: Apr 13, 2023 - Affected: fixed in 3.0.3. ### [CVE-2023-1545](https://cve.now/CVE-2023-1545): SQL Injection in nilsteampassnet/teampass - Severity: High 7.5 - Published: Mar 21, 2023 - Affected: fixed in 3.0.0.22. ### [CVE-2023-1463](https://cve.now/CVE-2023-1463): Authorization Bypass Through User-Controlled Key in nilsteampassnet/teampass - Severity: Medium 6.3 - Published: Mar 17, 2023 - Affected: fixed in 3.0.0.23. ### [CVE-2023-1070](https://cve.now/CVE-2023-1070): External Control of File Name or Path in nilsteampassnet/teampass - Severity: High 7.1 - Published: Feb 27, 2023 - Affected: fixed in 3.0.0.23. ### [CVE-2022-26980](https://cve.now/CVE-2022-26980): Teampass 2.1.26 allows reflected XSS via the index.php PATH\_INFO. - Severity: Unrated - Published: Mar 28, 2022 - Affected: through 2.1.26. ### [CVE-2020-11671](https://cve.now/CVE-2020-11671): Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to… - Severity: Unrated - Published: May 4, 2020 - Affected: through 2.1.27.36. ### [CVE-2020-12477](https://cve.now/CVE-2020-12477): The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an… - Severity: Unrated - Published: Apr 29, 2020 - Affected: through 2.1.27.36. ### [CVE-2020-12478](https://cve.now/CVE-2020-12478): TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. - Severity: Unrated - Published: Apr 29, 2020 - Affected: versions 2.1.27.36. ### [CVE-2020-12479](https://cve.now/CVE-2020-12479): TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with… - Severity: Unrated - Published: Apr 29, 2020 - Affected: through 2.1.27.36. ### [CVE-2019-17203](https://cve.now/CVE-2019-17203): TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder. - Severity: Unrated - Published: Oct 5, 2019 - Affected: through 2.1.27.36. ### [CVE-2019-17204](https://cve.now/CVE-2019-17204): TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item. - Severity: Unrated - Published: Oct 5, 2019 - Affected: through 2.1.27.36. ### [CVE-2019-17205](https://cve.now/CVE-2019-17205): TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. - Severity: Unrated - Published: Oct 5, 2019 - Affected: through 2.1.27.36. ### [CVE-2019-16904](https://cve.now/CVE-2019-16904): TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an… - Severity: Unrated - Published: Sep 26, 2019 - Affected: through 2.1.27.36. ### [CVE-2019-12950](https://cve.now/CVE-2019-12950): An issue was discovered in TeamPass 2.1.27.35. - Severity: Unrated - Published: Aug 6, 2019 - Affected: through 2.1.27.35. ### [CVE-2019-1000001](https://cve.now/CVE-2019-1000001): TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can… - Severity: Unrated - Published: Feb 4, 2019 - Affected: through 2.1.27. ### [CVE-2017-15055](https://cve.now/CVE-2017-15055): TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php. - Severity: Unrated - Published: Nov 27, 2017 - Affected: fixed in 2.1.27.9. ### [CVE-2017-15054](https://cve.now/CVE-2017-15054): An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files… - Severity: Unrated - Published: Nov 27, 2017 - Affected: fixed in 2.1.27.9. ### [CVE-2017-15053](https://cve.now/CVE-2017-15053): TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. - Severity: Unrated - Published: Nov 27, 2017 - Affected: fixed in 2.1.27.9. ### [CVE-2017-15052](https://cve.now/CVE-2017-15052): TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. - Severity: Unrated - Published: Nov 27, 2017 - Affected: fixed in 2.1.27.9. ### [CVE-2017-15051](https://cve.now/CVE-2017-15051): Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject… - Severity: Unrated - Published: Nov 27, 2017 - Affected: fixed in 2.1.27.9. ### [CVE-2017-15278](https://cve.now/CVE-2017-15278): Cross-Site Scripting (XSS) was discovered in TeamPass before 2.1.27.9. - Severity: Unrated - Published: Oct 12, 2017 - Affected: fixed in 2.1.27.9. ### [CVE-2017-9436](https://cve.now/CVE-2017-9436): TeamPass before 2.1.27.4 is vulnerable to a SQL injection in users.queries.php. - Severity: Unrated - Published: Jun 5, 2017 - Affected: fixed in 2.1.27.5. ### [CVE-2015-7564](https://cve.now/CVE-2015-7564): Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1)… - Severity: Unrated - Published: Apr 12, 2017 - Affected: fixed in 2.1.25. ### [CVE-2015-7562](https://cve.now/CVE-2015-7562): Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script… - Severity: Unrated - Published: Apr 12, 2017 - Affected: fixed in 2.1.25. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/nilsteampassnet/teampass Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.