{"cvss":0.0,"datePublished":"2026-06-01T00:00:00Z","dateUpdated":"2026-06-01T00:00:00Z","description":"mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).","dueDate":"","id":"CVE-2026-42167","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"ProFTPD","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"ProFTPD ProFTPD Improper Neutralization of Special Elements used in an SQL Command","vendor":"ProFTPD"}