Approved changes feed: RSS · Atom
cpe:2.3:a:apache:fineract:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Fineract (60d1637b-fbcc-54dc-9218-9a6e904e3163) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/fineract |
purl2cpe | 2026-06-01 10:14:24.260403 |
pkg:docker/apache/fineract |
purl2cpe | 2026-06-01 10:14:24.260405 |
pkg:github/apache/fineract |
purl2cpe | 2026-06-01 10:14:24.260406 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-58137 |
vulnerable | 2026-06-08 07:35:17.315896 |
Apache Fineract: IDOR via self-service API
Authorization Bypass Through User-Controlled Key vulnerability in Apache Fineract.
This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12.1.
Users are encouraged to upgrade to version 1.13.0, the latest release.
Published: 2025-12-12T09:21:00.374Z
Updated: 2025-12-12T19:35:44.785Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-58130 |
vulnerable | 2026-06-08 07:35:17.281920 |
Apache Fineract: Server Key not masked
Insufficiently Protected Credentials vulnerability in Apache Fineract.
This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12.1.
Users are encouraged to upgrade to version 1.13.0, the latest release.
Published: 2025-12-12T09:20:06.930Z
Updated: 2025-12-12T19:38:02.717Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-23408 |
vulnerable | 2026-06-08 07:10:55.714050 |
Apache Fineract: weak password policy
Weak Password Requirements vulnerability in Apache Fineract.
This issue affects Apache Fineract: through 1.10.1. The issue is fixed in version 1.11.0.
Users are encouraged to upgrade to version 1.13.0, the latest release.
Published: 2025-12-12T09:18:59.147Z
Updated: 2025-12-18T15:34:00.875Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-32838 |
vulnerable | 2026-06-08 06:37:24.122991 |
Apache Fineract: SQL injection vulnerabilities in offices API endpoint
SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Apache Fineract versions 1.9 and before have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API endpoints' query parameter.
Users are recommended to upgrade to version 1.10.1, which fixes this issue.
A SQL Validator has been implemented which allows us to configure a series of tests and checks against our SQL queries that will allow us to validate and protect against nearly all potential SQL injection attacks.
Published: 2025-02-12T09:44:15.943Z
Updated: 2025-02-12T18:03:27.737Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-23539 |
vulnerable | 2026-06-08 06:29:39.893393 |
Apache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.
HIGH (8.3)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5.
Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue.
Published: 2024-03-29T14:36:57.919Z
Updated: 2025-02-13T17:39:46.405Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-23538 |
vulnerable | 2026-06-08 06:29:39.892745 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-23537 |
vulnerable | 2026-06-08 06:29:39.891466 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-25197 |
vulnerable | 2026-06-08 05:56:08.665604 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-25196 |
vulnerable | 2026-06-08 05:56:08.665105 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-25195 |
vulnerable | 2026-06-08 05:56:08.664077 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-44635 |
vulnerable | 2026-06-08 05:49:35.920374 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-17514 |
vulnerable | 2026-06-08 05:20:56.634501 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-20243 |
vulnerable | 2026-06-08 05:11:26.894182 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11801 |
vulnerable | 2026-06-08 05:10:39.056135 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11800 |
vulnerable | 2026-06-08 05:10:39.055688 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.