CVE-2026-35152 Apache Fineract: SQL injection in runreports endpoint

A SQL Injection vulnerability exists in Apache Fineract's Report Execution API runreports endpoint in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run...

CVE-2026-35152

The CVE covers a SQL Injection in Apache Fineract’s Report Execution API (runreports endpoint) affecting versions up to and including 1.14.0. The vulnerability arises because report parameter values are embedded into the generated SQL without sufficient validation, enabling an authenticated user ...

EUVD-2025-210227

Unauthenticated Local File Inclusion in Ingenioso = 1.14.0 versions...

CVE-2025-69112

Unauthenticated Local File Inclusion in Planty = 1.14.0 versions...

CVE-2025-69117

Unauthenticated Local File Inclusion in Ingenioso = 1.14.0 versions...

CVE-2025-69117

CVE-2025-69117 concerns the Ingenioso WordPress theme (versions <= 1.14.0) with an unauthenticated Local File Inclusion (LFI). The connected PT-Security entries corroborate an LFI issue affecting Ingenioso

CVE-2025-69112

Technical details for CVE-2025-69112 (Planty WordPress theme

WordPress Ingenioso theme <= 1.14.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Ingenioso versions = 1.14.0...

WordPress TrustMate.io – WooCommerce integration plugin <= 1.16.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin TrustMate.io – WooCommerce integration versions = 1.16.0...