CVE-2021-33570

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/162831/Postbird-0.8.4-Cross-Site-Scripting-Local-File-Inclusion.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/162872/Postbird-0.8.4-XSS-LFI-Insecure-Data-Storage.htmlThird Party Advisory, VDB Entry
https://github.com/Paxa/postbird/issues/132Issue Tracking, Third Party Advisory
https://github.com/Paxa/postbird/issues/133Issue Tracking, Third Party Advisory
https://github.com/Paxa/postbird/issues/134Issue Tracking, Third Party Advisory
https://github.com/Tridentsec-io/postbirdExploit, Third Party Advisory
https://tridentsec.io/blogs/postbird-cve-2021-33570/Broken Link, Third Party Advisory, URL Repurposed
https://www.exploit-db.com/exploits/49910Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/162831/Postbird-0.8.4-Cross-Site-Scripting-Local-File-Inclusion.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/162872/Postbird-0.8.4-XSS-LFI-Insecure-Data-Storage.htmlThird Party Advisory, VDB Entry
https://github.com/Paxa/postbird/issues/132Issue Tracking, Third Party Advisory
https://github.com/Paxa/postbird/issues/133Issue Tracking, Third Party Advisory
https://github.com/Paxa/postbird/issues/134Issue Tracking, Third Party Advisory
https://github.com/Tridentsec-io/postbirdExploit, Third Party Advisory
https://tridentsec.io/blogs/postbird-cve-2021-33570/Broken Link, Third Party Advisory, URL Repurposed
https://www.exploit-db.com/exploits/49910Exploit, Third Party Advisory, VDB Entry

Timeline

Published: May 25, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-335717.5In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not CVE-2021-335726.5A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Linux Security whereby the FSAVD component used in certain F-Secure produ CVE-2021-335749.8The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attr CVE-2021-335759.8The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of usin CVE-2021-335769.8An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filename can include path-t CVE-2021-335775.3An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves (via encryption and CVE-2021-335789.8Echo ShareCare 8.15.5 is susceptible to SQL injection vulnerabilities when processing remote input from both authenticated and unauthenticat CVE-2021-335807.5User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex e CVE-2021-335817.2MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the f CVE-2021-335827.5Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled duri CVE-2021-335839.8REINER timeCard 6.05.07 installs a Microsoft SQL Server with an sa password that is hardcoded in the TCServer.jar file.CVE-2021-335864.3InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "m