Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

54 results · page 1 of 2

Oct 14, 2026Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).CVE-2026-89077 · Other software · Progress · reported by security@progress.comHigh 7.5
Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com
Oct 14, 2026Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module).CVE-2026-89076 · Other software · Progress · reported by security@progress.comHigh 7.2
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com
Oct 14, 2026Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.CVE-2026-89075 · Other software · Progress · reported by security@progress.comHigh 7.3
Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com
Oct 14, 2026Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.CVE-2026-89074 · Other software · Progress · reported by security@progress.comHigh 7.5
Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com
Oct 14, 2026Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.CVE-2026-89073 · Other software · Progress · reported by security@progress.comHigh 7.5
Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com
Oct 14, 2026Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).CVE-2026-89072 · Other software · Progress · reported by security@progress.comHigh 7.5
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com
Oct 14, 2026Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).CVE-2026-89071 · Other software · Progress · reported by security@progress.comHigh 7.5
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com
Oct 14, 2026Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).CVE-2026-89070 · Other software · Progress · reported by security@progress.comHigh 7.5
Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com
Oct 14, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).CVE-2026-89069 · Other software · Progress · reported by security@progress.comHigh 8
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com
Oct 14, 2026Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).CVE-2026-89068 · Other software · Progress · reported by security@progress.comHigh 8.1
Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com
Oct 14, 2026Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.CVE-2026-89067 · Other software · Progress · reported by security@progress.comHigh 8.8
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com
Oct 14, 2026Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.CVE-2026-87093 · Other software · Progress · reported by security@progress.comHigh 8.8
Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com
Jul 23, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer.CVE-2026-15968 · Other software · Progress · reported by security@progress.comHigh 7.1
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.progress.com
Jul 23, 2026Insufficient session expiration vulnerability in Progress MOVEit Transfer.CVE-2026-15967 · Other software · Progress · reported by security@progress.comHigh 7.5
Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.progress.com
Jul 23, 2026Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer.CVE-2026-15966 · Other software · Progress · reported by security@progress.comHigh 7.5
Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.progress.com
Jul 23, 2026Improper Authentication vulnerability in Progress MOVEit Transfer.CVE-2026-10697 · Other software · Progress · reported by security@progress.comHigh 7.5
Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.progress.com
Jul 8, 2026Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules).CVE-2026-8801 · Other software · Progress · reported by security@progress.comLow 3.5
Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.progress.com
Jul 8, 2026Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module).CVE-2026-8800 · Other software · Progress · reported by security@progress.comLow 2.7
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.progress.com
Jul 8, 2026Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module).CVE-2026-8651 · Other software · Progress · reported by security@progress.comLow 3.7
Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.progress.com
Jul 8, 2026Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module).CVE-2026-8650 · Other software · Progress · reported by security@progress.comMedium 4.5
Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.progress.com
Jul 8, 2026Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).CVE-2026-8649 · Other software · Progress · reported by security@progress.comMedium 6.4
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.progress.com
Jul 8, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).CVE-2026-11903 · Other software · Progress · reported by security@progress.comHigh 8
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: from 2026.0.0 before 2026.0.1, from 2025.1.0 before 2025.1.4, from 2025.0.0 before 2025.0.8.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com
Jul 8, 2026Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules).CVE-2026-10699 · Other software · Progress · reported by security@progress.comHigh 7.5
Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com
Jul 8, 2026Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).CVE-2026-10698 · Other software · Progress · reported by security@progress.comHigh 7.2
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com
Jan 7, 2026Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023CVE-2025-11235 · Other software · Progress · reported by security@progress.comLow 3.7
Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.progress.com
Nov 19, 2025Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4.CVE-2025-13147 · Other software · Progress · reported by security@progress.comMedium 5.3
Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.progress.com docs.progress.com
Oct 29, 2025Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, fromCVE-2025-10932 · Other software · Progress · reported by security@progress.comHigh 8.2
Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com
Mar 19, 2025Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This iCVE-2025-2324 · Other software · Progress · reported by security@progress.comMedium 5.9
Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.12, from 2024.0.0 before 2024.0.8, from 2024.1.0 before 2024.1.2.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com
Jul 29, 2024Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit Transfer: from 2023.0CVE-2024-6576 · Other software · Progress · reported by security@progress.comHigh 7.3
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.12, from 2023.1.0 before 2023.1.7, from 2024.0.0 before 2024.0.3.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com progress.com
Jun 25, 2024Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.CVE-2024-5806 · Other software · Progress · reported by security@progress.comCritical 9.1
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com progress.com
Mar 20, 2024 In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerabiCVE-2024-2291 · Other software · Progress Software · reported by security@progress.comMedium 4.3
In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered. An authenticated user could manipulate a request to bypass the logging mechanism within the web application which results in user activity not being logged properly.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com progress.com
Jan 17, 2024 In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue CVE-2024-0396 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.1
In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue was discovered. An authenticated user can manipulate a parameter in an HTTPS transaction. The modified transaction could lead to computational errors within MOVEit Transfer and potentially result in a denial of service.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com progress.com
Nov 29, 2023 In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with groCVE-2023-6218 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.2
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group members permissions to the role of an organization administrator.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com progress.com
Nov 29, 2023 In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerabCVE-2023-6217 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.1
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer. An attacker could craft a malicious payload targeting the system which comprises a MOVEit Gateway and MOVEit Transfer deployment. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victim’s browser.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com progress.com
Sep 20, 2023 In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability CVE-2023-42660 · Other software · Progress Software Corporation · reported by security@progress.comHigh 8.8
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to the MOVEit Transfer machine interface which could result in modification and disclosure of MOVEit database content.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com progress.com
Sep 20, 2023 In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site scriptiCVE-2023-42656 · Other software · Progress Software Corporation · reported by security@progress.comMedium 6.1
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site scripting (XSS) vulnerability has been identified in MOVEit Transfer's web interface. An attacker could craft a malicious payload targeting MOVEit Transfer users during the package composition procedure. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com progress.com
Sep 20, 2023 In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability CVE-2023-40043 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.2
In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer web interface that could allow a MOVEit system administrator account to gain unauthorized access to the MOVEit Transfer database. A MOVEit system administrator could submit a crafted payload to the MOVEit Transfer web interface which could result in modification and disclosure of MOVEit database content.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com progress.com
Jul 5, 2023In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQLCVE-2023-36934 · Other software · Progress · reported by MITRECritical 9.1
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
Product
Moveit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com progress.com
Jul 5, 2023In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attaCVE-2023-36933 · Other software · Progress · reported by MITREHigh 7.5
In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a method that results in an unhandled exception. Triggering this workflow can cause the MOVEit Transfer application to terminate unexpectedly.
Product
Moveit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com progress.com
Jul 5, 2023In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), multiCVE-2023-36932 · Other software · Progress · reported by MITREHigh 8.1
In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), multiple SQL injection vulnerabilities have been identified in the MOVEit Transfer web application that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
Product
Moveit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com progress.com
Jun 16, 2023In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerabilCVE-2023-35708 · Other software · Progress · reported by MITRECritical 9.8
In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content. These are fixed versions of the DLL drop-in: 2020.1.10 (12.1.10), 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3).
Product
Moveit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com cisa.gov
Jun 11, 2023In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabilitCVE-2023-35036 · Other software · Progress · reported by MITRECritical 9.1
In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabilities have been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
Product
Moveit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archive.is community.progress.com
Jun 2, 2023Progress MOVEit Transfer SQL Injection VulnerabilityCVE-2023-34362 · Other software · Progress · reported by MITREExploitedRansomwareCritical 9.8
Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.
Product
MOVEit Transfer
On CISA’s list since
Jun 2, 2023 (federal fix deadline Jun 23, 2023)
What to do
Attackers are using this now. Install Progress’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Aug 7, 2021In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web application could allow an unauthenticated rCVE-2021-38159 · Other software · Progress · reported by MITRECritical 9.8
In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web application could allow an unauthenticated remote attacker to gain access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or execute SQL statements that alter or delete database elements, via crafted strings sent to unique MOVEit Transfer transaction types. The fixed versions are 2019.0.8 (11.0.8), 2019.1.7 (11.1.7), 2019.2.4 (11.2.4), 2020.0.7 (12.0.7), 2020.1.6 (12.1.6), and 2021.0.4 (13.0.4).
Product
Moveit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com progress.com
Aug 5, 2021In certain Progress MOVEit Transfer versions before 2021.0.3 (aka 13.0.3), SQL injection in the MOVEit Transfer web application could allow an authenticated remCVE-2021-37614 · Other software · Progress · reported by MITREHigh 8.8
In certain Progress MOVEit Transfer versions before 2021.0.3 (aka 13.0.3), SQL injection in the MOVEit Transfer web application could allow an authenticated remote attacker to gain access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or execute SQL statements that alter or delete database elements, via crafted strings sent to unique MOVEit Transfer transaction types. The fixed versions are 2019.0.7 (11.0.7), 2019.1.6 (11.1.6), 2019.2.3 (11.2.3), 2020.0.6 (12.0.6), 2020.1.5 (12.1.5), and 2021.0.3 (13.0.3).
Product
Moveit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com docs.ipswitch.com
Jun 9, 2021In Progress MOVEit Transfer before 2019.0.6 (11.0.6), 2019.1.x before 2019.1.5 (11.1.5), 2019.2.x before 2019.2.2 (11.2.2), 2020.x before 2020.0.5 (12.0.5), 202CVE-2021-33894 · Other software · Progress · reported by MITREHigh 8.8
In Progress MOVEit Transfer before 2019.0.6 (11.0.6), 2019.1.x before 2019.1.5 (11.1.5), 2019.2.x before 2019.2.2 (11.2.2), 2020.x before 2020.0.5 (12.0.5), 2020.1.x before 2020.1.4 (12.1.4), and 2021.x before 2021.0.1 (13.0.1), a SQL injection vulnerability exists in SILUtility.vb in MOVEit.DMZ.WebApp in the MOVEit Transfer web app. This could allow an authenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database and/or execute SQL statements that alter or delete database elements.
Product
Moveit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com progress.com
May 18, 2021In Progress MOVEit Transfer before 2021.0 (13.0), a SQL injection vulnerability has been found in the MOVEit Transfer web app that could allow an authenticated CVE-2021-31827 · Other software · Progress · reported by MITREHigh 8.8
In Progress MOVEit Transfer before 2021.0 (13.0), a SQL injection vulnerability has been found in the MOVEit Transfer web app that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or destroy database elements. This is in MOVEit.DMZ.WebApp in SILHuman.vb.
Product
Moveit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com docs.ipswitch.com
Nov 17, 2020In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application.CVE-2020-28647 · Other software · Progress · reported by MITREMedium 5.4
In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer instance interacts with the stored payload, it could invoke and execute arbitrary code within the context of the victim's browser (XSS).
Product
Moveit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.progress.com labs.secforce.com
Feb 14, 2020In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could alCVE-2020-8612 · Other software · Progess · reported by MITRECritical 9
In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could allow an authenticated attacker to execute arbitrary code in a victim's browser, aka XSS.
Product
Moveit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.ipswitch.com docs.ipswitch.com
Feb 14, 2020In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that couldCVE-2020-8611 · Other software · Progess · reported by MITREHigh 8.8
In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database via the REST API. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or destroy database elements.
Product
Moveit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.ipswitch.com docs.ipswitch.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.