CVE-2025-63572

Description A SQL injection vulnerability was discovered in the endpoint responsible for searching for platform clients Zentrajuris v.1.0. User input sent to the search parameter is concatenated directly into a SQL query without proper sanitization/parameterization, allowing the attacker to...

CVE-2026-56287

A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API GET /api/v1/clients in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with...

CVE-2026-56287

Apache Fineract versions up to and including 1.14.0 (and prior to 1.14.1) are vulnerable to a boolean-based SQL Injection in the Client Search API (GET /api/v1/clients). The root cause is the lack of sufficient validation when the orderBy and sortOrder request parameters are concatenated into a S...

EUVD-2026-44603

A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API GET /api/v1/clients in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with...

CVE-2026-56287 Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure

A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API GET /api/v1/clients in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with...

CVE-2026-56287 Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure

A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API GET /api/v1/clients in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with...

CVE-2026-56287 Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure

A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API GET /api/v1/clients in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with...

PT-2026-58895

Name of the Vulnerable Software and Affected Versions Apache Fineract versions prior to 1.14.1 Description An authenticated user with permissions to view clients can exploit a boolean-based SQL Injection in the Client Search API endpoint '/api/v1/clients'. The issue occurs because the orderBy and...

CVE-2026-56287: Improper Neutralization of Special Elements used in an SQL Command

A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API GET /api/v1/clients in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with...

CVE-2024-51209

Anuj Kumar's Client Management System Version 1.2 (also identified as PHPGurukul Client Management System ) is vulnerable to Cross-Site Scripting (XSS) . The root cause is the improper neutralization of input during web page generation, specifically within the search input field parameter . This ...

PT-2024-34561

Name of the Vulnerable Software and Affected Versions Anuj Kumar's Client Management System version 1.2 Description The issue allows local attackers to inject arbitrary web script or HTML via the search input field parameter to admin search invoice page and client search invoice page. This is a...

CVE-2024-51209

Cross-Site Scripting XSS vulnerabilities in Anuj Kumar's Client Management System Version 1.2 allow local attackers to inject arbitrary web script or HTML via the search input field parameter to admin search invoice page and client search invoice page...

CVE-2024-22719

SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client...

Velociraptor 0.7.0 Release: Dig Deeper With Enhanced Client Search, Server Improvements and Expanded VQL Library

Carlos Canto contributed to this article. Rapid7 is thrilled to announce version 0.7.0 of Velociraptor is now LIVE and available for download. The focus of this release was on improving user efficiency while also expanding and strengthening the library of VQL plug-ins and artifacts. Let’s take a...