CVE-2026-65874

This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...

CVE-2026-65874 Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints

This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...

EUVD-2026-113749

This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...

CVE-2026-65874

Apache Fineract versions up to and including 1.15.0 are vulnerable to time-based blind SQL injection . The vulnerability exists because the Center read endpoint and several datatable entry read endpoints concatenate caller-supplied ordering parameters (orderBy, sortOrder, and order) directly into...