What’s Vulnerable › Products

Apache Software Foundation Apache Fineract vulnerabilities

23 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your Apache Software Foundation Apache Fineract version is affected

Latest Apache Software Foundation Apache Fineract vulnerabilities

• CVE-2026-57821 — Apache Fineract: Office list: SQL Injection via Subquery in orderBy (CVSS 8.1)
• CVE-2026-56287 — Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure (CVSS 8.1)
• CVE-2026-35152 — Apache Fineract: SQL injection in runreports endpoint (CVSS 8.8)
• CVE-2025-58137 — Apache Fineract: IDOR via self-service API (CVSS 8.1)
• CVE-2025-58130 — Apache Fineract: Server Key not masked (CVSS 9.1)
• CVE-2025-23408 — Apache Fineract: weak password policy (CVSS 6.5)
• CVE-2024-32838 — Apache Fineract: SQL injection vulnerabilities in offices API endpoint (CVSS 8.8)
• CVE-2024-23539 — Apache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries. (CVSS 9.8)
• CVE-2024-23538 — Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries. (CVSS 9.8)
• CVE-2024-23537 — Apache Fineract: Under certain circumstances, this vulnerability allowed users, without specific permissions, to escalate their privileges to any role. (CVSS 8.8)
• CVE-2023-25197 — apache fineract: SQL injection vulnerability in certain procedure calls (CVSS 6.3)
• CVE-2023-25196 — Apache Fineract: SQL injection vulnerability (CVSS 4.3)
• CVE-2023-25195 — Apache Fineract: SSRF template type vulnerability in certain authenticated users (CVSS 8.1)
• CVE-2022-44635 — Apache Fineract allowed an authenticated user to perform remote code execution due to path traversal (CVSS 8.8)
• CVE-2020-17514 — disabled hostname verificiation (CVSS 7.4)
• CVE-2018-20243 — (CVSS 7.5)
• CVE-2018-11801 — (CVSS 9.8)
• CVE-2018-11800 — (CVSS 9.8)
• CVE-2018-1292 — (CVSS 8.1)
• CVE-2018-1291 — (CVSS 8.1)
• CVE-2018-1290 — (CVSS 9.8)
• CVE-2018-1289 — (CVSS 8.8)
• CVE-2017-5663 — (CVSS 8.8)