Not rated
CVE-2017-5663 In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with…
Description
In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able to inject malicious SQL into SELECT queries. The 'sqlSearch' parameter on a number of endpoints is not sanitized and appended directly to the query.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Fineract | 0.6.0-incubating | No fix stated |
| Apache Fineract | 0.5.0-incubating | No fix stated |
| Apache Fineract | 0.4.0-incubating | No fix stated |
Other CVEs of Apache Fineract
The 22 CVEs of Apache Fineract →
CVE-2026-64618
Apache Fineract: SQL injection vulnerability in Search API
Not rated
CVE-2026-65874
Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints
Not rated
CVE-2026-57821
A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to…
Not rated
CVE-2026-35152
A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to…
Not rated