253 matches found
CVE-2026-57821-PoC-Exploit
CVE-2026-57821 – Apache Fineract SQL Injection LEGAL & ETHICAL NOTICE This toolkit is provided strictly for educational, training, and authorized security testing purposes. Unauthorized use against any system without explicit written permission is illegal and violates computer crime laws. The...
CVE-2026-64618
Improper Neutralization of Special Elements used in an SQL Command "SQL Injection" vulnerability exists in Apache Fineract through version 1.15.0. The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowi...
CVE-2026-65874
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...
CVE-2026-64618
Improper Neutralization of Special Elements used in an SQL Command "SQL Injection" vulnerability exists in Apache Fineract through version 1.15.0. The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowi...
CVE-2026-64618 Apache Fineract: SQL injection vulnerability in Search API
Improper Neutralization of Special Elements used in an SQL Command "SQL Injection" vulnerability exists in Apache Fineract through version 1.15.0. The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowi...
CVE-2026-64618
A SQL Injection vulnerability exists in Apache Fineract (through version 1.15.0) due to insufficient input neutralization. The flaw specifically affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint. An attacker could potentia...
CVE-2026-64618 Apache Fineract: SQL injection vulnerability in Search API
Improper Neutralization of Special Elements used in an SQL Command "SQL Injection" vulnerability exists in Apache Fineract through version 1.15.0. The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowi...
EUVD-2026-113752
Improper Neutralization of Special Elements used in an SQL Command "SQL Injection" vulnerability exists in Apache Fineract through version 1.15.0. The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowi...
CVE-2026-65874
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...
EUVD-2026-113749
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...
CVE-2026-65874 Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...
CVE-2026-65874 Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...
CVE-2026-65874
This vulnerability affects Apache Fineract versions up to and including 1.15.0 . The issue stems from the Center read endpoint and datatable entry read endpoints directly concatenating caller-supplied ordering parameters (orderBy , sortOrder , order ) into the SQL ORDER BY clause. Because the exi...
Apache Fineract SQL injection vulnerability
Apache Fineract versions 1.15.0 and earlier contain an SQL injection vulnerability. This vulnerability arises because the Center read endpoint and the datatable entry read endpoint directly append the orderBy, sortOrder, and order parameters provided by callers to the SQL ORDER BY clause. Existin...
CVE-2026-64618: Apache Software Foundation Apache Fineract: Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache…
Improper Neutralization of Special Elements used in an SQL Command "SQL Injection" vulnerability exists in Apache Fineract through version 1.15.0. The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowi...
PT-2026-133315
Name of the Vulnerable Software and Affected Versions Apache Fineract versions prior to 1.16.1 Description An SQL injection issue exists due to insufficient neutralization of special elements used in SQL commands. The flaw affects the /fineract-provider/api/v1/search/advance API endpoint via the...
CVE-2026-65874: Apache Software Foundation Apache Fineract: This issue affects Apache Fineract versions up to and including 1.15.0
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...
PT-2026-133306
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...
Apache Fineract SQL Injection
The vulnerability of the Apache Fineract digital financial services platform lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary SQL code...
