Apache Fineract vulnerabilities

• apache fineract Apache Fineract: SQL injection vulnerability in Search API CVE-2026-64618 9.8 CriticalOctober 30, 2026
• apache fineract Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints CVE-2026-65874 8.8 HighOctober 30, 2026
• apache fineract Apache Fineract: Office list: SQL Injection via Subquery in orderBy CVE-2026-57821 Public exploit 8.1 HighJuly 15, 2026
• apache fineract Apache Fineract: SQL injection in runreports endpoint CVE-2026-35152 8.8 HighJuly 15, 2026
• apache fineract Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure CVE-2026-56287 8.1 HighJuly 15, 2026
• apache fineract Apache Fineract: IDOR via self-service API CVE-2025-58137 8.1 HighDecember 12, 2025
• apache fineract Apache Fineract: Server Key not masked CVE-2025-58130 9.1 CriticalDecember 12, 2025
• apache fineract Apache Fineract: weak password policy CVE-2025-23408 8.5 HighDecember 12, 2025
• apache fineract Apache Fineract: SQL injection vulnerabilities in offices API endpoint CVE-2024-32838 9.4 CriticalFebruary 12, 2025
• apache fineract Apache Fineract: Under certain circumstances, this vulnerability allowed users, without specific permissions, to escalate their privileges to any role. CVE-2024-23537 8.4 HighMarch 29, 2024
• apache fineract Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries. CVE-2024-23538 9.9 CriticalMarch 29, 2024
• apache fineract Apache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database quer… CVE-2024-23539 8.3 HighMarch 29, 2024
• apache fineract apache fineract: SQL injection vulnerability in certain procedure calls CVE-2023-25197 6.3 MediumMarch 28, 2023
• apache fineract Apache Fineract: SQL injection vulnerability CVE-2023-25196 4.3 MediumMarch 28, 2023
• apache fineract Apache Fineract: SSRF template type vulnerability in certain authenticated users CVE-2023-25195 8.1 HighMarch 28, 2023
• apache fineract Apache Fineract allowed an authenticated user to perform remote code execution due to path traversal CVE-2022-44635 EPSS 68.8% 8.8 HighNovember 29, 2022
• apache fineract disabled hostname verificiation CVE-2020-17514 7.4 HighMay 27, 2021
• apache fineract The implementation of POST with the username and password in the URL parameters exposed the... CVE-2018-20243 7.5 HighOctober 13, 2020
• apache fineract SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary... CVE-2018-11801 9.8 CriticalJune 11, 2019
• apache fineract SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary... CVE-2018-11800 9.8 CriticalJune 11, 2019
• apache fineract Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0... CVE-2018-1292 8.1 HighApril 20, 2018
• apache fineract Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different... CVE-2018-1291 8.1 HighApril 20, 2018
• apache fineract In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a... CVE-2018-1290 9.8 CriticalApril 20, 2018
• apache fineract In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the... CVE-2018-1289 8.8 HighApril 20, 2018
• apache fineract In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated... CVE-2017-5663 8.8 HighDecember 14, 2017