[nilsteampassnet/teampass] Cross-site Scripting in teampass

Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO. Someone must open a link for the Teampass Password Manager index page containing malicious payload.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-26980
• https://gist.github.com/RNPG/6919286e0daebce7634d0a744e060dca
• https://github.com/nilsteampassnet/TeamPass/commits/teampass_2
• https://github.com/advisories/GHSA-m2wv-m5pf-284r