Progress Software · weakness class
SQL Injection
21 CVEs · 2 exploited
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- exploited in the wild
- 2
- check available
- 3
- likely to be exploited
- 3
Every one of the 21 is a mark on the map. Named now: 1 to 21, most at risk first.
- MOVEit Transfer - Remote Code Execution
- WhatsUp Gold HasErrors SQL Injection - Authentication Bypass
- MOVEit Transfer - SQL Injection
- MOVEit Transfer - SQL Injection
- WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypass
- In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), multiple SQL injection v…
- WhatsUp Gold GetSqlWhereClause SQL Injection Privilege Escalation Vulnerability
- In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabilities have been found…
- WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability
- WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability
- WhatsUp Gold GetOrderByClause SQL Injection Privilege Escalation Vulnerability
- WS_FTP Server SQL Injection via Administrative Interface
- WhatsUp Gold getMonitorJoin SQL Injection Privilege Escalation Vulnerability
- MOVEit Transfer Machine Interface SQL Injection
- MOVEit Transfer System Administrator SQL Injection
- Table scope bypass vulnerability in custom reports
- MOVEit Transfer SQL injection in custom reporting
- Institution scope bypass vulnerability in custom reports
- SQL injection leading to privilege escalation in Progress Flowmon ADS
- Possibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADS
- Chef Automate SQL Injection Vulnerability
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.