CVE-2021-38159

In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web application could allow an unauthenticated remote attacker to gain access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or execute SQL statements that alter or delete database elements, via crafted strings sent to unique MOVEit Transfer transaction types. The fixed versions are 2019.0.8 (11.0.8), 2019.1.7 (11.1.7), 2019.2.4 (11.2.4), 2020.0.7 (12.0.7), 2020.1.6 (12.1.6), and 2021.0.4 (13.0.4).

• CWE-89

• https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-August-6-2021Vendor Advisory
• https://www.progress.com/moveitProduct, Vendor Advisory
• https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-August-6-2021Vendor Advisory
• https://www.progress.com/moveitProduct, Vendor Advisory

Published

Aug 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38152index.php/appointment/insert_patient_add_appointment in Chik…5.4
• CVE-2021-38153Some components in Apache Kafka use `Arrays.equals` to valid…5.9
• CVE-2021-38154Certain Canon devices manufactured in 2012 through 2020 (suc…7.5
• CVE-2021-38155OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x bef…7.5
• CVE-2021-38156In Nagios XI before 5.8.6, XSS exists in the dashboard page …5.4
• CVE-2021-38157LeoStream Connection Broker 9.x before 9.0.34.3 allows Unaut…6.1
• CVE-2021-3816Cacti 1.1.38 allows authenticated users with User Management…5.4
• CVE-2021-38160In drivers/char/virtio_console.c in the Linux kernel before …7.8
• CVE-2021-38161Improper Authentication vulnerability in TLS origin verifica…8.1
• CVE-2021-38162SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64…9.4
• CVE-2021-38163SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31…8.8
• CVE-2021-38164SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - S…5.4