CVE-2026-42167
mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of US
CVSS
8.1
Alta
EPSS
7.4%
p95
KEV
—
Exploit Today
28
0-100
Publicado: 28 de abr. de 2026 · Última mod.: 24 de jul. de 2026 · CWE-89
7.3%EPSS · 30 dias7.4%
2026-10-172026-11-13
mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).
- www.proftpd.orghttp://www.proftpd.org/docs/RELEASE_NOTES-1.3.10rc1
- github.comhttps://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc
- github.comhttps://github.com/proftpd/proftpd/issues/2052
- www.openwall.comhttps://www.openwall.com/lists/oss-security/2026/05/01/4
- zeropath.comhttps://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2026/05/01/13
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2026/05/01/4
- github.comhttps://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1291817.3 ALT—
——0A vulnerability has been found in projectworlds Visitor Management System 1.0. This issue affects the function mysqli_query of the file /img/user%20page.php of the component Login Endpoint. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.21hCVE-2026-1291807.3 ALT—
——0A flaw has been found in projectworlds Visitor Management System 1.0. This vulnerability affects the function mysqli_query of the file actionpage.php. This manipulation of the argument purpose causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.1dCVE-2026-1291719.8 CRÍ—
——0NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to append SQL via the id and locationType parameters of /api/stats/:type. Attackers can close the quoted table-name identifier and use error-based output to read database contents, and read or write server files via PostgreSQL superuser functions.1dCVE-2026-1291666.5 MÉD—
——0Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which inserts bracket-indexed JSON keys from CEL filters unescaped into JSON path expressions for SQLite, PostgreSQL, and MySQL. Authenticated users with read:alert permission can submit crafted CEL expressions to /alerts/query or the cel parameter of /incidents, using result counts as a boolean oracle to extract other tenants' alerts and password hashes.1dCVE-2026-1291606.5 MÉD—
——0free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the orderBy parameter of the /apis/share/pages endpoint verbatim into the ORDER BY clause via MyBatis-Flex without a column whitelist. Authenticated users can supply CASE WHEN subquery expressions that use share ordering as a boolean oracle to read arbitrary database contents, such as share codes.1dCVE-2026-1240416.5 MÉD—
——0Catalis/Patriot Properties WebPro 5.0 allows a remote unauthenticated attacker to execute arbitrary SQL queries against the underlying MSSQL database, enabling exfiltration of sensitive property and taxpayer information.1d