FI
Product
Fineract
23
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 14Medium 3Low 0
Watch
Add Fineract to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-35152 | 8.8 | Jul 15 | Apache Fineract: SQL injection in runreports endpoint Affected: before 1.15.0 |
| CVE-2024-32838 | 8.8 | Feb 12 | SQL Injection vulnerability in various API endpoints - offices, dashboards, etc Affected: 1.4.0 before 1.10.1 |
| CVE-2024-23537 | 8.8 | Mar 29 | Improper Privilege Management vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5 Affected: before 1.9.0 |
| CVE-2022-44635 | 8.8 | Nov 29 | Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an… Affected: before 1.8.1 |
| CVE-2018-1289 | 8.8 | Apr 20 | In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the system exposes different REST end points to query domain specific entities with a… Affected: 0.4.0; 0.5.0; 0.6.0; 1.0.0 |
| CVE-2017-5663 | 8.8 | Dec 14 | In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able to inject malicious… Affected: 0.4.0-incubating; 0.5.0-incubating; 0.6.0-incubating |
| CVE-2026-57821 | 8.1 | Jul 15 | Apache Fineract: Office list: SQL Injection via Subquery in orderBy Affected: before 1.15.0 |
| CVE-2026-56287 | 8.1 | Jul 15 | Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure Affected: before 1.15.0 |
| CVE-2025-58137 | 8.1 | Dec 12 | Authorization Bypass Through User-Controlled Key vulnerability in Apache Fineract Affected: before 1.12.1 |
| CVE-2023-25195 | 8.1 | Mar 28 | Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract Affected: 1.4.0 through 1.8.3 |
| CVE-2018-1292 | 8.1 | Apr 20 | Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, a hacker could inject SQL to read/update data for which he… Affected: 0.4.0; 0.5.0; 0.6.0; 1.0.0 |
| CVE-2018-1291 | 8.1 | Apr 20 | Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different REST end points to query domain specific entities with a Query Parameter 'orderBy'… Affected: 0.4.0; 0.5.0; 0.6.0; 1.0.0 |
| CVE-2018-20243 | 7.5 | Oct 13 | The implementation of POST with the username and password in the URL parameters exposed the credentials Affected: 1.0.0 through 1.3.0; 0.4.0; 0.5.0; 0.6.0 |
| CVE-2020-17514 | 7.4 | May 27 | Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method Affected: before 1.5.0 |
Showing 14