CVE-2023-3083

HighCVSS 8.7/10Last modified Jun 17, 2026

Description

Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
nilsteampassnet	nilsteampassnet/teampass	>= unspecified, < 3.0.9

References

https://github.com/nilsteampassnet/teampass/commit/79731553fa305d45dabb7a227f3074d56d7c94c1Patch
https://huntr.dev/bounties/c6b29e46-02e0-43ad-920f-28ac482ea2abExploit, Patch, Third Party Advisory
https://github.com/nilsteampassnet/teampass/commit/79731553fa305d45dabb7a227f3074d56d7c94c1Patch
https://huntr.dev/bounties/c6b29e46-02e0-43ad-920f-28ac482ea2abExploit, Patch, Third Party Advisory

Timeline

Published: Jun 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-308377.5Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior CVE-2023-308389.9PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isCleanHTML()` method of Pr CVE-2023-308398.8PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO use CVE-2023-30848.1Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-308407.8Fluid is an open source Kubernetes-native distributed dataset orchestrator and accelerator for data-intensive applications. Starting in vers CVE-2023-308415.5Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector d CVE-2023-308436.5Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that con CVE-2023-308448.8Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in `muta CVE-2023-308459.8ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure. ESPv2 2.20.0 through 2.42.0 contains CVE-2023-308467.5typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library v CVE-2023-308478.2H2O is an HTTP server. In versions 2.3.0-beta2 and prior, when the reverse proxy handler tries to processes a certain type of invalid HTTP r CVE-2023-308488.8Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection v