{"id":"CVE-2021-33570","aliases":["EUVD-2021-20258","GHSA-38qm-8h84-7h9v"],"status":"published","title":"Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL...","description":"Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03561,"percentile":0.89422,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2021-05-25T21:06:34Z","modified":"2026-10-20T10:54:48Z","exploits":[{"source":"exploitdb","id":"EDB-49910","title":"Postbird 0.8.4 - Javascript Injection","type":"webapps","platform":"multiple","date":"2021-05-27","url":"https://www.exploit-db.com/exploits/49910"}],"products":[{"vendor":"postbird_project","product":"postbird"}],"references":[{"url":"https://github.com/Paxa/postbird/issues/132","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/Paxa/postbird/issues/133","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/Paxa/postbird/issues/134","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/Tridentsec-io/postbird","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"http://packetstormsecurity.com/files/162831/Postbird-0.8.4-Cross-Site-Scripting-Local-File-Inclusion.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://packetstormsecurity.com/files/162872/Postbird-0.8.4-XSS-LFI-Insecure-Data-Storage.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.exploit-db.com/exploits/49910","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://tridentsec.io/blogs/postbird-cve-2021-33570/","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory","URL Repurposed","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33570"},{"url":"https://github.com/advisories/GHSA-38qm-8h84-7h9v"}],"sources":{"cve":[{"id":"CVE-2021-33570","description":"Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.","status":"published","published":"2021-05-25T21:06:34Z","modified":"2024-08-03T23:50:43.174Z","updated_at":"2026-11-02T14:33:10.555814Z"}],"euvd":[{"id":"EUVD-2021-20258","description":"Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.","status":"published","published":"2021-05-25T21:06:34Z","modified":"2024-08-03T23:50:43Z","updated_at":"2026-11-03T03:24:33.866739Z"}],"ghsa":[{"id":"GHSA-38qm-8h84-7h9v","title":"Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL...","description":"Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.","status":"published","published":"2022-05-24T19:03:23Z","modified":"2023-01-29T05:07:46Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:46:11.123221Z"}],"nvd":[{"id":"CVE-2021-33570","description":"Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.","status":"published","published":"2021-05-25T22:15:10.353Z","modified":"2026-06-17T03:54:48.483Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:53.987491Z"}],"osv":[{"id":"CVE-2021-33570","description":"Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.","status":"published","published":"2021-05-25T22:15:10.353Z","modified":"2026-10-20T10:54:48.221148172Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:20.13324Z"}]}}