~ / search / GHSA-m2wv-m5pf-284r

GHSA-m2wv-m5pf-284r

Cross-site Scripting in teampass

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-26980

Packages

EcosystemPackageAffectedFixed in
Packagist nilsteampassnet/teampass <= 2.1.26 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO. Someone must open a link for the Teampass Password Manager index page containing malicious payload.

References

External links from the advisory. They lead to third-party sites.