Apache Software Foundation Apache Fineract

• CVE-2026-64618 Unrated Apache Fineract: SQL injection vulnerability in Search API 0.6%
• CVE-2026-65874 Unrated Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints 0.6%
• CVE-2026-57821 High 8.1 Apache Fineract: Office list: SQL Injection via Subquery in orderBy 0.7%
• CVE-2026-35152 High 8.8 Apache Fineract: SQL injection in runreports endpoint 3.3%
• CVE-2026-56287 High 8.1 Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure 0.7%
• CVE-2025-58137 High 8.1 Apache Fineract: IDOR via self-service API 0.4%
• CVE-2025-58130 Critical 9.1 Apache Fineract: Server Key not masked 0.4%
• CVE-2025-23408 High 8.5 Apache Fineract: weak password policy 0.5%
• CVE-2024-32838 Critical 9.4 Apache Fineract: SQL injection vulnerabilities in offices API endpoint 1.5%
• CVE-2024-23537 High 8.4 Apache Fineract: Under certain circumstances, this vulnerability allowed users, without specific permissions, to escalate their privileges to any role. 1.1%
• CVE-2024-23538 Critical 9.9 Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries. 1.3%
• CVE-2024-23539 High 8.3 Apache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries. 1.5%
• CVE-2023-25197 Unrated apache fineract: SQL injection vulnerability in certain procedure calls 1.1%
• CVE-2023-25196 Unrated Apache Fineract: SQL injection vulnerability 1.3%
• CVE-2023-25195 High 8.1 Apache Fineract: SSRF template type vulnerability in certain authenticated users 1.0%
• CVE-2022-44635 High 8.8 Apache Fineract allowed an authenticated user to perform remote code execution due to path traversal 68.8%
• CVE-2020-17514 Unrated disabled hostname verificiation 3.4%