CVE-2021-33894

In Progress MOVEit Transfer before 2019.0.6 (11.0.6), 2019.1.x before 2019.1.5 (11.1.5), 2019.2.x before 2019.2.2 (11.2.2), 2020.x before 2020.0.5 (12.0.5), 2020.1.x before 2020.1.4 (12.1.4), and 2021.x before 2021.0.1 (13.0.1), a SQL injection vulnerability exists in SILUtility.vb in MOVEit.DMZ.WebApp in the MOVEit Transfer web app. This could allow an authenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database and/or execute SQL statements that alter or delete database elements.

• CWE-89

• https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-June-2021Patch, Vendor Advisory
• https://www.progress.com/moveitProduct, Vendor Advisory
• https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-June-2021Patch, Vendor Advisory
• https://www.progress.com/moveitProduct, Vendor Advisory

Published

Jun 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33883A Cleartext Transmission of Sensitive Information vulnerabil…7.5
• CVE-2021-33884An Unrestricted Upload of File with Dangerous Type vulnerabi…9.1
• CVE-2021-33885An Insufficient Verification of Data Authenticity vulnerabil…9.8
• CVE-2021-33886An improper sanitization of input vulnerability in B. Braun …8.8
• CVE-2021-33887Insufficient verification of data authenticity in Peloton TT…6.8
• CVE-2021-33889OpenThread wpantund through 2021-07-02 has a stack-based Buf…6.8
• CVE-2021-33895ETINET BACKBOX E4.09 and H4.09 mismanages password access co…8.1
• CVE-2021-33896Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Tr…5.3
• CVE-2021-33897A buffer overflow in Synthesia before 10.7.5567, when a non-…5.5
• CVE-2021-33898In Invoice Ninja before 4.4.0, there is an unsafe call to un…8.1
• CVE-2021-33900While investigating DIRSTUDIO-1219 it was noticed that confi…7.5
• CVE-2021-33903In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCO…8.8