Fineract (Apache) - vulnerabilities (CVEs)

23 CVEs, 0 in the last 30 days, 35 known versions, newest CVE from 2026-07-15. Vendor: Apache.

CVEs of Fineract

• CVE-2026-57821 - CVSS 8.1 (high), 2026-07-15: A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request…
• CVE-2026-35152 - CVSS 8.8 (high), 2026-07-15: A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter…
• CVE-2026-56287 - CVSS 8.1 (high), 2026-07-15: A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and including 1.14.0. The…
• CVE-2025-58130 - CVSS 9.1 (critical), 2025-12-12: Insufficiently Protected Credentials vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version…
• CVE-2025-58137 - CVSS 8.1 (high), 2025-12-12: Authorization Bypass Through User-Controlled Key vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.11.0. The issue is fixed in…
• CVE-2025-23408 - CVSS 8.5 (high), 2025-12-12: Weak Password Requirements vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.10.1. The issue is fixed in version 1.11.0. Users…
• CVE-2024-32838 - CVSS 9.4 (critical), 2025-02-12: SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Apache Fineract versions 1.9 and before have a vulnerability that allows an…
• CVE-2024-23539 - CVSS 9.8 (critical), 2024-03-29: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract:…
• CVE-2024-23538 - CVSS 9.9 (critical), 2024-03-29: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract:…
• CVE-2024-23537 - CVSS 8.8 (high), 2024-03-29: Improper Privilege Management vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended to upgrade to version 1.9.0,…
• CVE-2023-25197 - CVSS 6.3 (medium), 2023-03-28: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation apache fineract. Authorized…
• CVE-2023-25196 - CVSS 4.3 (medium), 2023-03-28: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache Fineract. Authorized…
• CVE-2023-25195 - CVSS 8.1 (high), 2023-03-28: Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract. Authorized users with limited permissions can gain access to…
• CVE-2022-44635 - CVSS 8.8 (high), 2022-11-29: Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache…
• CVE-2020-17514 - CVSS 7.4 (high), 2021-05-27: Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the…
• CVE-2018-20243 - CVSS 7.5 (high), 2020-10-13: The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fineract jira issues…
• CVE-2018-11801 - CVSS 9.8 (critical), 2019-06-11: SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on a m_center data related table.
• CVE-2018-11800 - CVSS 9.8 (critical), 2019-06-11: SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on the GroupSummaryCounts related…
• CVE-2018-1290 - CVSS 9.8 (critical), 2018-04-20: In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape with two continuous SQL parameters…
• CVE-2018-1289 - CVSS 8.8 (high), 2018-04-20: In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the system exposes different REST end points to query domain specific…
• CVE-2018-1292 - CVSS 8.1 (high), 2018-04-20: Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, a hacker could inject SQL to read/update…
• CVE-2018-1291 - CVSS 8.1 (high), 2018-04-20: Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different REST end points to query domain specific entities with a Query…
• CVE-2017-5663 - CVSS 8.8 (high), 2017-12-14: In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is…