Advisories · Technology

Apache Software Foundation Apache Fineract.

Every CVE that names Apache Software Foundation Apache Fineract among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-64618 CVE record

Apache Fineract: SQL injection vulnerability in Search API
- Apache Software Foundation Apache Fineract
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-65874 CVE record

Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints
- Apache Software Foundation Apache Fineract
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-57821 CVE record

CVSS 8.1 High

Apache Fineract: Office list: SQL Injection via Subquery in orderBy
- Apache Software Foundation Apache Fineract
- SQL injection
Not analysed yet 15 Jul 2026
CVE-2026-35152 CVE record

CVSS 8.8 High

Apache Fineract: SQL injection in runreports endpoint
- Apache Software Foundation Apache Fineract
- SQL injection
Not analysed yet 15 Jul 2026
CVE-2026-56287 CVE record

CVSS 8.1 High

Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure
- Apache Software Foundation Apache Fineract
- SQL injection
Not analysed yet 15 Jul 2026
CVE-2025-58137 CVE record

CVSS 8.1 High

Apache Fineract: IDOR via self-service API
- Apache Software Foundation Apache Fineract
- Broken access control
Not analysed yet 12 Dec 2025
CVE-2025-58130 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Fineract: Server Key not masked
- Apache Software Foundation Apache Fineract
- Hard-coded credentials
Not analysed yet 12 Dec 2025
CVE-2025-23408 CVE record

CVSS 8.5 High

Apache Fineract: weak password policy
- Apache Software Foundation Apache Fineract
- Hard-coded credentials
Not analysed yet 12 Dec 2025
CVE-2024-32838 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Apache Fineract: SQL injection vulnerabilities in offices API endpoint
- Apache Software Foundation Apache Fineract
- SQL injection
Not analysed yet 12 Feb 2025
CVE-2024-23537 CVE record

CVSS 8.4 High

Apache Fineract: Under certain circumstances, this vulnerability allowed users, without specific permissions, to escalate their privileges to any role.
- Apache Software Foundation Apache Fineract
- Privilege escalation
Not analysed yet 29 Mar 2024
CVE-2024-23538 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.
- Apache Software Foundation Apache Fineract
- SQL injection
Not analysed yet 29 Mar 2024
CVE-2024-23539 CVE record

CVSS 8.3 High

Apache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database que…
- Apache Software Foundation Apache Fineract
- SQL injection
Not analysed yet 29 Mar 2024
CVE-2023-25197 CVE record

apache fineract: SQL injection vulnerability in certain procedure calls
- Apache Software Foundation apache fineract
- SQL injection
Not analysed yet 28 Mar 2023
CVE-2023-25196 CVE record

Apache Fineract: SQL injection vulnerability
- Apache Software Foundation Apache Fineract
- SQL injection
Not analysed yet 28 Mar 2023
CVE-2023-25195 CVE record

CVSS 8.1 High

Apache Fineract: SSRF template type vulnerability in certain authenticated users
- Apache Software Foundation Apache Fineract
- Server-side request forgery (SSRF)
Not analysed yet 28 Mar 2023
CVE-2022-44635 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

Apache Fineract allowed an authenticated user to perform remote code execution due to path traversal
- Apache Software Foundation Apache Fineract
- Path traversal
Not analysed yet 29 Nov 2022
CVE-2020-17514 CVE record

disabled hostname verificiation
- Apache Software Foundation Apache Fineract
Not analysed yet 27 May 2021
CVE-2018-1292 CVE record

Apache Software Foundation Apache Fineract: Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating…
- Apache Software Foundation Apache Fineract
Not analysed yet 20 Apr 2018
CVE-2018-1291 CVE record

Apache Software Foundation Apache Fineract: Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating…
- Apache Software Foundation Apache Fineract
Not analysed yet 20 Apr 2018
CVE-2018-1290 CVE record

Apache Software Foundation Apache Fineract: In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating…
- Apache Software Foundation Apache Fineract
Not analysed yet 20 Apr 2018
CVE-2018-1289 CVE record

Apache Software Foundation Apache Fineract: In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating…
- Apache Software Foundation Apache Fineract
Not analysed yet 20 Apr 2018
CVE-2017-5663 CVE record

Apache Software Foundation Apache Fineract: In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating…
- Apache Software Foundation Apache Fineract
Not analysed yet 14 Dec 2017