CVE-2024-23538

CVE-2024-23538 concerns Apache Fineract prior to version 1.8.5, where an SQL Injection can be triggered by improper neutralization in the sqlSearch parameter. The vulnerability stems from unsafely constructed SQL statements, enabling an attacker to view, modify, or delete data in the backend data...

CVE-2024-23539

CVE-2024-23539 affects Apache Fineract up to version 1.8.5 (pre-1.8.5). The issue is an SQL Injection vulnerability arising from improper neutralization of special elements in the sqlSearch parameter of specific endpoints, enabling an attacker to view, add, modify, or delete information in the ba...

CVE-2024-23537

CVE-2024-23537 is an elevation-of-privilege vulnerability in Apache Fineract . Reports describe an improper privilege management issue that, under certain circumstances, could allow users to escalate to any role. Affected versions are listed as earlier than 1.9.0, with 1.9.0 identified as the fix...

CVE-2022-44635

CVE-2022-44635 affects Apache Fineract up to version 1.8.0. A path traversal vulnerability in the file upload component allows an authenticated user to trigger remote code execution. Impact and exploitability details indicate a network-remote condition with high risk (authenticated with low privi...

CVE-2018-11800

CVE-2018-11800 affects Apache Fineract prior to 1.3.0, enabling SQL injection through a query on the GroupSummaryCounts related table. CVSSv3 base score 9.8 (CRITICAL); CVSSv2 base score 7.5 (HIGH).

CVE-2018-11801

CVE-2018-11801 pertains to Apache Fineract and is a SQL injection vulnerability present in versions before 1.3.0, allowing an attacker to execute arbitrary SQL commands via a query on a center-related table. The issue is documented across multiple sources (NVD entry and CNVD/OSV entries) with con...

CVE-2020-17514

Apache Fineract up to version 1.5.0 disables HTTPS hostname verification in ProcessorHelper.configureClient, enabling potential MITM if hostname checks are not performed. This affects the client-communication security path and is documented across multiple sources (e.g., RH security pages and CVE...

CVE-2025-23408

CVE-2025-23408 concerns Apache Fineract and is described as a Weak Password Requirements vulnerability. Affected versions are listed as through 1.10.1, with a fix in 1.11.0. Upgrading to the latest release (1.13.0) is advised. The root cause is a weak password policy that could undermine authenti...

CVE-2025-58137

The Apache Fineract digital financial services platform is vulnerable to an authorization bypass caused by an insecure direct object reference (IDOR) flaw. An attacker could exploit this vulnerability to bypass authorization controls, specifically via the self-service API . This issue affects ver...

CVE-2026-57821

Apache Fineract versions up to and including 1.14.0 are vulnerable to a SQL Injection in the Office Search API (GET /api/v1/offices). The root cause is the insufficient validation of the orderBy request parameter, which is concatenated directly into a SQL query. This is a bypass of the ColumnVali...

CVE-2026-56287

Apache Fineract versions up to and including 1.14.0 (and prior to 1.14.1) are vulnerable to a boolean-based SQL Injection in the Client Search API (GET /api/v1/clients). The root cause is the lack of sufficient validation when the orderBy and sortOrder request parameters are concatenated into a S...

CVE-2026-35152

A SQL Injection vulnerability exists in Apache Fineract versions up to and including 1.14.0 within the Report Execution API (specifically the runreports endpoint). The root cause is the incorporation of report parameter values into generated SQL queries without sufficient validation. This allows ...

CVE-2025-58130

The Apache Fineract digital financial services platform is vulnerable to an insufficiently protected credentials issue in versions through 1.11.0 . The root cause is an information disclosure vulnerability where server key data is not properly masked. An attacker could exploit this flaw to obtain...