CVE-2026-44331Disclosure

LOWCVSS 8.1 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
5 mentions across 4 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 2 classified signals
Peaked 3d ago at 2 mentions (2026-05-05); latest day: 1
5 total mentions across 4 days

Deep dive

Activity timeline5 mentions / 4d

Signal classification3 categories

Disclosure

240.0%

General

240.0%

PoC

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-05	2	Disclosure2
2026-05-06	1	PoC1
2026-05-07	1	General1
2026-05-13	1	General1

Full discourse5 posts

Vulmon Vulnerability Feed@VulmonFeeds158d
Disclosure
CVE-2026-44331 SQL Injection in ProFTPD Through 1.3.9a via Reverse DNS Lookup https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44331
Post summary
The note reports an SQL injection flaw in ProFTPD 1.3.9a discovered through reverse DNS lookup, providing the vulnerability type but lacking details on exploitation or mitigation.
00001154
4.0K followersView on X
IntegSec@integ_sec150d
General
CVE-2026-44331: ProFTPD SQL injection in mod_wrap2_sql.c - What It Means for Your Business and How to Respond https://hubs.li/Q04gs8Bq0
Post summary
The article announces a new SQL injection vulnerability in ProFTPD’s mod_wrap2_sql.c (CVE-2026-44331) and discusses its business impact and response strategies, but it does not provide a PoC, exploit code, patch details, or evidence of real‑world exploitation.
0000028
30 followersView on X
Boaz Kodjo BoazAK@BoazakK157d
General
ProFTPD Vulnerability (CVE-2026-44331) https://www.linkedin.com/posts/boazak_kodjododjango-infoseckodjo-cybersecurity-activity-7457943536882053120-an8c?utm_source=social_share_send&utm_medium=member_desktop_web&rcm=ACoAACNNYt0B4WVczIWTpX-nwPT_3sK5eU_lt4U #KodjoDoDjango #InfoSecKodjo #CyberSecurity #Vulnerability #SQLInjection #ProFTPD #CVE2026 #Infosec #SecurityAlert
Post summary
The LinkedIn post simply mentions CVE‑2026‑44331 with a link to the profile; no actionable or detailed information is included.
0000062
797 followersView on X
Hephaestvs@Vulcanux_158d
PoC
csirt_it: ‼ #ProFTPD: disponibile PoC per lo sfruttamento della CVE-2026-44331 presente nel noto server FTP open source. Rischio: 🔴 Tipologia: 🔸 Security Restrictions Bypass 🔗 https://www.acn.gov.it/portale/w/rilevata-vulnerabilita-in-proftpd-poc-pubblico-per-lo-sfruttamento-della-cve-2026-44331 ⚠️ Importante mantenere aggiornati i sistemi ⚠️ https://t.co/DBN6eBx7DY
Post summary
A PoC for CVE-2026-44331 on ProFTPD has been released and shared via a link, with a reminder to keep systems updated.
0000057
610 followersView on X
CVE@CVEnew158d
Disclosure
CVE-2026-44331 In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arb… https://www.cve.org/CVERecord?id=CVE-2026-44331
Post summary
CVE-2026-44331 is a SQL injection vulnerability in ProFTPD that allows remote attackers to inject arbitrary input; the text provides technical details but no PoC, exploit, or evidence of active exploitation.
00000158
57.4K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-44331

IntegSec[verified]@integ_secGeneral

The article announces a new SQL injection vulnerability in ProFTPD’s mod_wrap2_sql.c (CVE-2026-44331) and discusses its business impact and response strategies, but it does not provide a PoC, exploit code, patch details, or evidence of real‑world exploitation.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The note reports an SQL injection flaw in ProFTPD 1.3.9a discovered through reverse DNS lookup, providing the vulnerability type but lacking details on exploitation or mitigation.

Boaz Kodjo BoazAK@BoazakKGeneral

The LinkedIn post simply mentions CVE‑2026‑44331 with a link to the profile; no actionable or detailed information is included.

Hephaestvs@Vulcanux_PoC

A PoC for CVE-2026-44331 on ProFTPD has been released and shared via a link, with a reminder to keep systems updated.

CVE@CVEnewDisclosure

CVE-2026-44331 is a SQL injection vulnerability in ProFTPD that allows remote attackers to inject arbitrary input; the text provides technical details but no PoC, exploit, or evidence of active exploitation.