SB2026092265 - Cross-site scripting in TeamPass

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026092265

SB2026092265 - Cross-site scripting in TeamPass

Published: September 22, 2026

Security Bulletin ID SB2026092265
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in another user's browser session.

The vulnerability exists due to improper output encoding in client-side rendering code when rendering user-controlled item labels, folder titles, directory attributes, and identity fields. A remote privileged user can store crafted values to execute arbitrary JavaScript in another user's browser session.

User interaction is required to open an affected screen.


Remediation

Install update from vendor's website.

References