CVE-2021-33563

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-916

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/koel/koel/releases/tag/v5.1.4Third Party Advisory
https://huntr.dev/bounties/1-other-koel/koel/Exploit, Issue Tracking, Third Party Advisory
https://github.com/koel/koel/releases/tag/v5.1.4Third Party Advisory
https://huntr.dev/bounties/1-other-koel/koel/Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: May 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-335649.8An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files CVE-2021-335705.4Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading lo CVE-2021-335717.5In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not CVE-2021-335726.5A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Linux Security whereby the FSAVD component used in certain F-Secure produ CVE-2021-335749.8The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attr CVE-2021-335759.8The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of usin CVE-2021-335769.8An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filename can include path-t CVE-2021-335775.3An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves (via encryption and CVE-2021-335789.8Echo ShareCare 8.15.5 is susceptible to SQL injection vulnerabilities when processing remote input from both authenticated and unauthenticat CVE-2021-335807.5User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex e CVE-2021-335817.2MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the f CVE-2021-335827.5Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled duri