CVE-2025-58137

< 1.12.1

Authorization Bypass Through User-Controlled Key vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.

8.1HIGH

CVE-2025-58130

< 1.12.1

Insufficiently Protected Credentials vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.11.0. The i

9.1CRITICAL

CVE-2025-23408

< 1.11.0

Weak Password Requirements vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.10.1. The issue is fi

6.5MEDIUM

CVE-2024-32838

>= 1.4.0 and < 1.10.1

SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Apache Fineract versions 1.9 and before have a vu

8.8HIGH

CVE-2024-23539

< 1.9.0

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue a

8.3HIGH

CVE-2024-23538

< 1.9.0

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue a

9.9CRITICAL

CVE-2024-23537

< 1.9.0

Improper Privilege Management vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended

8.4HIGH

CVE-2023-25197

>= 1.4.0 and <= 1.8.2

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation a

6.3MEDIUM

CVE-2023-25196

>= 1.4.0 and <= 1.8.2

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation A

4.3MEDIUM

CVE-2023-25195

>= 1.4.0 and <= 1.8.3

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract. Authorized users with limited perm

8.1HIGH

CVE-2022-44635

< 1.8.1

Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upl

8.8HIGH

CVE-2020-17514

< 1.5.0

Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typica

7.4HIGH

CVE-2018-20243

>= 1.0.0 and <= 1.3.0

The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is avail

7.5HIGH

CVE-2018-11801

< 1.3.0

SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on a m_

9.8CRITICAL

CVE-2018-11800

< 1.3.0

SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on the

9.8CRITICAL

CVE-2018-1292

all versions

Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, a hacker could i

8.1HIGH

CVE-2018-1291

all versions

Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different REST end points to query domain spec

8.1HIGH

CVE-2018-1290

all versions

In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape with two

9.8CRITICAL

CVE-2018-1289

all versions

In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the system exposes different REST end poi

8.8HIGH

CVE-2017-5663

all versions

In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/g

8.8HIGH