CVE-2021-33496

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Dutchcoders transfer.sh before 1.2.4 allows XSS via an inline view.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/dutchcoders/transfer.sh/commit/9df18fdc69de2e71f30d8c1e6bfab2fda2e52eb4Patch, Third Party Advisory
https://github.com/dutchcoders/transfer.sh/pull/373Patch, Third Party Advisory
https://github.com/dutchcoders/transfer.sh/releases/tag/v1.2.4Third Party Advisory
https://github.com/dutchcoders/transfer.sh/releases/tag/v1.2.4Third Party Advisory
https://github.com/dutchcoders/transfer.sh/releases/tag/v1.2.4Third Party Advisory
https://github.com/dutchcoders/transfer.sh/releases/tag/v1.2.4Third Party Advisory
https://vuln.ryotak.me/advisories/43Third Party Advisory
https://github.com/dutchcoders/transfer.sh/commit/9df18fdc69de2e71f30d8c1e6bfab2fda2e52eb4Patch, Third Party Advisory
https://github.com/dutchcoders/transfer.sh/pull/373Patch, Third Party Advisory
https://github.com/dutchcoders/transfer.sh/releases/tag/v1.2.4Third Party Advisory
https://github.com/dutchcoders/transfer.sh/releases/tag/v1.2.4Third Party Advisory
https://github.com/dutchcoders/transfer.sh/releases/tag/v1.2.4Third Party Advisory
https://github.com/dutchcoders/transfer.sh/releases/tag/v1.2.4Third Party Advisory
https://vuln.ryotak.me/advisories/43Third Party Advisory

Timeline

Published: May 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-334979.1Dutchcoders transfer.sh before 1.2.4 allows Directory Traversal for deleting files.CVE-2021-334987.5Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 1 of 2).CVE-2021-334997.5Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 2 of 2).CVE-2021-33506.1deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter.CVE-2021-335007.5PuTTY before 0.75 on Windows allows remote servers to cause a denial of service (Windows GUI hang) by telling the PuTTY window to change its CVE-2021-335019.6Overwolf Client 0.169.0.22 allows XSS, with resultant Remote Code Execution, via an overwolfstore:// URL.CVE-2021-335027.5The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service CVE-2021-335037.5An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the auth CVE-2021-335044.9Couchbase Server before 7.1.0 has Incorrect Access Control.CVE-2021-335057.8A local malicious user can circumvent the Falco detection engine through 0.28.1 by running a program that alters arguments of system calls b CVE-2021-335067.5jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrict_room_creation is set by default. This can allow an attacker CVE-2021-335076.1Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow