Fineract
Vendor:
First CVE: Dec 14, 2017 · Active for 8 years
23
Total CVEs
More Total CVEs than 95% of tracked products
2.3
Avg CVEs / Year
Higher CVE frequency than 73% of tracked products
8.3
Avg CVSS
Higher Avg CVSS than 74% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Fineract over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 14, 2017
8 years ago
Most Recent CVE
Jul 15, 2026
9 days ago
CVE Severity & Scoring
Fineract23 CVEs
13%
61%
26%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network23 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low22 (95.7%)
High1 (4.3%)
Unknown0 (0.0%)
User Interaction
None23 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low14 (60.9%)
High0 (0.0%)
None9 (39.1%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (23 CVEs).
23 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-44635HIGH Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an atta | Nov 29, 2022 | 8.8 | 66 | NO | NO |
CVE-2026-35152HIGH A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter values are incorporate | Jul 15, 2026 | 8.8 | 42 | NO | NO |
CVE-2026-57821HIGH A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request parameter is concatena | Jul 15, 2026 | 8.1 | 38 | NO | NO |
CVE-2026-56287HIGH A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and including 1.14.0. The orderBy and sortOrder re | Jul 15, 2026 | 8.1 | 38 | NO | NO |
CVE-2018-11801CRITICAL SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on a m_center data related table. | Jun 11, 2019 | 9.8 | 33 | NO | NO |
CVE-2018-11800CRITICAL SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on the GroupSummaryCounts related table. | Jun 11, 2019 | 9.8 | 33 | NO | NO |
CVE-2018-1290CRITICAL In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape with two continuous SQL parameters can cause a SQL injectio | Apr 20, 2018 | 9.8 | 31 | NO | NO |
CVE-2024-23539CRITICAL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5.
Users are recomme | Mar 29, 2024 | 9.8 | 30 | NO | NO |
CVE-2025-58130CRITICAL Insufficiently Protected Credentials vulnerability in Apache Fineract.
This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12.1.
Users are encoura | Dec 12, 2025 | 9.1 | 29 | NO | NO |
CVE-2024-23538CRITICAL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5.
Users are recomme | Mar 29, 2024 | 9.8 | 29 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (23 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (23 CVEs).
Media Mentions
Signals from CVEs in this product scope (23 CVEs).
Top CNAs Publishing CVEs For Fineract
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.0.0 | 4 | 8.7 | 2.6% | 0 | 0 |
| 0.6.0-incubating | 1 | 8.8 | 2.1% | 0 | 0 |
| 0.6.0 | 5 | 8.5 | 2.6% | 0 | 0 |
| 0.5.0-incubating | 1 | 8.8 | 2.1% | 0 | 0 |
| 0.5.0 | 5 | 8.5 | 2.6% | 0 | 0 |
| 0.4.0-incubating | 1 | 8.8 | 2.1% | 0 | 0 |
| 0.4.0 | 5 | 8.5 | 2.6% | 0 | 0 |