ProFTPD

An authenticated SQL injection vulnerability (CVE-2026-42167) in the ProFTPD mod_sql module allows attackers to achieve remote code execution, with a functional exploit now publicly available.

A remote, authenticated attacker can exploit multiple vulnerabilities in ProFTPD to achieve arbitrary code execution and disclose confidential information, leading to system compromise and data theft.

An authenticated remote attacker can exploit a vulnerability within ProFTPD to initiate a denial-of-service attack, leading to the unavailability of the FTP service. This flaw could be triggered by legitimate users or adversaries with valid credentials, causing operational disruption.

A remote, anonymous attacker can exploit a SQL injection vulnerability in ProFTPD, potentially leading to unauthorized data access or modification.

An anonymous remote attacker can exploit a SQL injection vulnerability in ProFTPD.