What is the CVSS score of CVE-2026-44331?

CVE-2026-44331 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of ProFTPD are affected by CVE-2026-44331?

ProFTPD versions 1.3.9a and earlier contain a high-severity SQL injection vulnerability in the reverse DNS lookup module that allows remote attackers to execute arbitrary SQL commands when specific…. A patch is available.

Is there a public PoC exploit available for CVE-2026-44331?

Yes, a public proof-of-concept exploit is available for CVE-2026-44331. Prioritise patching immediately. EPSS: 0.0%.

ProFTPD CVE-2026-44331

EUVD-2026-27484 HIGH

SQL Injection (CWE-89)

2026-05-05 mitre

GHSA-jmg2-v72j-gmvc

SQLi Suse

8.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 05, 2026 - 20:32 vuln.today

Analysis Generated

May 05, 2026 - 20:32 vuln.today

DescriptionNVD

In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.

AnalysisAI

SQL injection in ProFTPD 1.3.9a and earlier allows remote attackers to execute arbitrary SQL commands when the 'UseReverseDNS on' configuration is enabled. The vulnerability exists in mod_wrap2_sql.c where attacker-controlled reverse DNS hostnames are passed unescaped into SQL queries during client access control checks. …

RemediationAI

Within 24 hours: Identify all ProFTPD instances running version 1.3.9a or earlier and verify UseReverseDNS configuration status via 'proftpd.conf' review. Within 7 days: For systems with UseReverseDNS enabled, disable this feature (set 'UseReverseDNS off') or apply upstream fix via GitHub commit 7666224 if available in your build pipeline; test thoroughly in staging. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

More from same product – last 7 days

CVE-2026-9256 HIGH This Week

8.1 May 22

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers

Vendor StatusVendor

CVE-2026-44331 vulnerability details – vuln.today

Back

ProFTPD CVE-2026-44331

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

More from same product – last 7 days

Vendor StatusVendor

Share

External POC / Exploit Code