CVE-2017-15051

Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTML via the (1) URL value of an item or (2) user log history. To exploit the vulnerability, the attacker must be first authenticated to the application. For the first one, the attacker has to simply inject XSS code within the URL field of a shared item. For the second one however, the attacker must prepare a payload within its profile, and then ask an administrator to modify its profile. From there, whenever the administrator accesses the log, it can be XSS'ed.

• CWE-79

• http://blog.amossys.fr/teampass-multiple-cve-01.htmlExploit, Technical Description, Third Party Advisory
• https://github.com/nilsteampassnet/TeamPass/commit/5f16f6bb132138ee04eb1e0debf2bdc7d7b7a15fPatch
• http://blog.amossys.fr/teampass-multiple-cve-01.htmlExploit, Technical Description, Third Party Advisory
• https://github.com/nilsteampassnet/TeamPass/commit/5f16f6bb132138ee04eb1e0debf2bdc7d7b7a15fPatch

Published

Nov 27, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15044The default installation of DocuWare Fulltext Search server …
• CVE-2017-15045LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3…
• CVE-2017-15046LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a st…5.5
• CVE-2017-15047The clusterLoadConfig function in cluster.c in Redis 4.0.2 a…
• CVE-2017-15048Stack-based buffer overflow in the ZoomLauncher binary in th…8.8
• CVE-2017-15049The ZoomLauncher binary in the Zoom client for Linux before …8.8
• CVE-2017-15052TeamPass before 2.1.27.9 does not properly enforce manager a…
• CVE-2017-15053TeamPass before 2.1.27.9 does not properly enforce manager a…
• CVE-2017-15054An arbitrary file upload vulnerability, present in TeamPass …
• CVE-2017-15055TeamPass before 2.1.27.9 does not properly enforce item acce…
• CVE-2017-15056p_lx_elf.cpp in UPX 3.94 mishandles ELF headers, which allow…
• CVE-2017-1506IBM Cognos TM1 10.2 and 10.2.2 is vulnerable to cross-site s…