262 matches found
CVE-2026-57821-PoC-Exploit
CVE-2026-57821 – Apache Fineract SQL Injection LEGAL & ETHICAL NOTICE This toolkit is provided strictly for educational, training, and authorized security testing purposes. Unauthorized use against any system without explicit written permission is illegal and violates computer crime laws. The...
CVE-2026-65874
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...
CVE-2026-64618
Improper Neutralization of Special Elements used in an SQL Command "SQL Injection" vulnerability exists in Apache Fineract through version 1.15.0. The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowi...
EUVD-2026-113752
Improper Neutralization of Special Elements used in an SQL Command "SQL Injection" vulnerability exists in Apache Fineract through version 1.15.0. The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowi...
CVE-2026-64618
An SQL injection vulnerability (CWE-89) exists in Apache Fineract affecting versions up to and including 1.15.0 . The flaw is caused by insufficient input neutralization in the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint. This a...
CVE-2026-64618 Apache Fineract: SQL injection vulnerability in Search API
Improper Neutralization of Special Elements used in an SQL Command "SQL Injection" vulnerability exists in Apache Fineract through version 1.15.0. The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowi...
EUVD-2026-113749
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...
CVE-2026-65874
Apache Fineract versions up to and including 1.15.0 are vulnerable to time-based blind SQL injection . The vulnerability exists because the Center read endpoint and several datatable entry read endpoints concatenate caller-supplied ordering parameters (orderBy, sortOrder, and order) directly into...
CVE-2026-65874 Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...
Apache Fineract SQL Injection
The vulnerability of the Apache Fineract digital financial services platform lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary SQL code...
Exploit for SQL Injection in Apache Fineract
🛡️ CVE-2026-57821 – Apache Fineract SQL Injection ⚠️ LEG...
CVE-2026-56287
A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API GET /api/v1/clients in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with...
CVE-2026-35152
A SQL Injection vulnerability exists in Apache Fineract's Report Execution API runreports endpoint in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run...
EUVD-2026-44605
A SQL Injection vulnerability exists in Apache Fineract's Office Search API GET /api/v1/offices in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to...
CVE-2026-57821 Apache Fineract: Office list: SQL Injection via Subquery in orderBy
A SQL Injection vulnerability exists in Apache Fineract's Office Search API GET /api/v1/offices in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to...
CVE-2026-57821 Apache Fineract: Office list: SQL Injection via Subquery in orderBy
A SQL Injection vulnerability exists in Apache Fineract's Office Search API GET /api/v1/offices in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to...
CVE-2026-57821
Apache Fineract versions up to and including 1.14.0 are vulnerable to a SQL Injection in the Office Search API (GET /api/v1/offices). The root cause is the insufficient validation of the orderBy request parameter, which is concatenated directly into a SQL query. This is a bypass of the ColumnVali...
CVE-2026-57821 Apache Fineract: Office list: SQL Injection via Subquery in orderBy
A SQL Injection vulnerability exists in Apache Fineract's Office Search API GET /api/v1/offices in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to...
CVE-2026-57821
A SQL Injection vulnerability exists in Apache Fineract's Office Search API GET /api/v1/offices in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to...
CVE-2026-35152
A SQL Injection vulnerability exists in Apache Fineract's Report Execution API runreports endpoint in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run...