CVE-2021-31827

In Progress MOVEit Transfer before 2021.0 (13.0), a SQL injection vulnerability has been found in the MOVEit Transfer web app that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or destroy database elements. This is in MOVEit.DMZ.WebApp in SILHuman.vb.

• CWE-89

• https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-April-2021Patch, Vendor Advisory
• https://docs.ipswitch.com/MOVEit/Transfer2021/ReleaseNotes/en/index.htmRelease Notes, Vendor Advisory
• https://www.progress.com/moveitProduct, Vendor Advisory
• https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-April-2021Patch, Vendor Advisory
• https://docs.ipswitch.com/MOVEit/Transfer2021/ReleaseNotes/en/index.htmRelease Notes, Vendor Advisory
• https://www.progress.com/moveitProduct, Vendor Advisory

Published

May 18, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-31819In Halibut versions prior to 4.4.7 there is a deserialisatio…9.8
• CVE-2021-3182D-Link DCS-5220 devices have a buffer overflow. NOTE: This v…8
• CVE-2021-31820In Octopus Server after version 2018.8.2 if the Octopus Serv…7.5
• CVE-2021-31821When the Windows Tentacle docker image starts up it logs all…5.5
• CVE-2021-31822When Octopus Tentacle is installed on a Linux operating syst…7.8
• CVE-2021-31826Shibboleth Service Provider 3.x before 3.2.2 is prone to a N…7.5
• CVE-2021-31828An SSRF issue in Open Distro for Elasticsearch (ODFE) before…7.1
• CVE-2021-31829kernel/bpf/verifier.c in the Linux kernel through 5.12.1 per…5.5
• CVE-2021-3183Files.com Fat Client 3.3.6 allows authentication bypass beca…7.5
• CVE-2021-31830Improper Neutralization of Input During Web Page Generation …4.8
• CVE-2021-31831Incorrect access to deleted scripts vulnerability in McAfee …5.5
• CVE-2021-31832Improper Neutralization of Input in the ePO administrator ex…4.8