{"id":"GHSA-m2wv-m5pf-284r","aliases":["CVE-2022-26980"],"title":"Cross-site Scripting in teampass","description":"Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO. Someone must open a link for the Teampass Password Manager index page containing malicious payload.","severity":"medium","score":6.1,"published":"2022-03-29T00:01:09.000Z","modified":"2023-11-08T04:08:55.839Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"nilsteampassnet/teampass","ranges":[{"events":[{"introduced":"0"},{"last_affected":"2.1.26"}],"type":"ECOSYSTEM"}],"versions":["2.1.21","2.1.26"],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2022-26980","https://gist.github.com/RNPG/6919286e0daebce7634d0a744e060dca","https://github.com/nilsteampassnet/TeamPass/commits/teampass_2"],"sources":[{"name":"OSV","id":"GHSA-m2wv-m5pf-284r","modified":"2023-11-08T04:08:55.839917Z","url":"https://osv.dev/vulnerability/GHSA-m2wv-m5pf-284r"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}]}