Teampass password manager versions before 3.1.5.16 are vulnerable to a stored cross‑site scripting flaw that occurs during the password import process. Unsanitized user data is inserted into the database and later rendered without proper encoding, enabling attackers to embed malicious scripts that run in the browsers of any user who views the imported passwords. This stored XSS can be leveraged for session hijacking, credential theft, privilege escalation, and overall compromise of application integrity.

The vulnerability affects the Teampass password manager by the vendor Teampass, specifically all releases earlier than 3.1.5.16. The issue is mitigated in the official patch 3.1.5.24.

The CVSS score of 9.3 signals a critical risk level. Although an EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the high severity indicates that an exploit would be valuable. The attack likely requires a user account with permission to import passwords; once a malicious import is performed, any user who accesses the affected page will trigger the payload, making the vulnerability widely exploitable across the user base.