Vulnerability record · CVE-2024-23539 · published 29 March 2024

CVE-2024-23539: Apache fineract sql injection vulnerability

Apache · Fineract

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue.

9.8 CVSS 3.1 Critical EPSS 1.5% · top 26.9% CWE-89 · SQL injection

9.8CVSS 3.1 base score

1.5%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Fineract Apache

References

Link	Tags
http://www.openwall.com/lists/oss-security/2024/03/29/3	Mailing List
https://cwiki.apache.org/confluence/display/FINERACT/Apache+Fineract+Security+Report	Vendor Advisory
https://lists.apache.org/thread/g8sv1gnjv716lx2h89jbvjdgtrrjmy7h	Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2024/03/29/3	Mailing List
https://cwiki.apache.org/confluence/display/FINERACT/Apache+Fineract+Security+Report	Vendor Advisory
https://lists.apache.org/thread/g8sv1gnjv716lx2h89jbvjdgtrrjmy7h	Mailing ListVendor Advisory

Track CVE-2024-23539 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-23538Apache fineract sql injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Finer…EPSS 1.3%29 Mar 2024 9.8CVE-2018-11800Apache fineract sql injection vulnerabilitySQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on the GroupSummaryCounts …EPSS 5.2%11 Jun 2019 9.8CVE-2018-11801Apache fineract sql injection vulnerabilitySQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on a m_center data related…EPSS 5.2%11 Jun 2019 9.8CVE-2018-1290Apache fineract sql injection vulnerabilityIn Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape with two continuous SQL para…EPSS 3.3%20 Apr 2018 9.4CVE-2024-32838Apache fineract sql injection vulnerabilitySQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Apache Fineract versions 1.9 and before have a vulnerability that al…EPSS 1.5%12 Feb 2025 9.1CVE-2025-58130Apache fineract insufficiently protected credentials vulnerabilityInsufficiently Protected Credentials vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.11.0. The issue is fixed in vers…EPSS 0.43%12 Dec 2025 8.8CVE-2026-35152Apache fineract sql injection vulnerabilityA SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report p…EPSS 3.3%15 Jul 2026 8.8CVE-2024-23537Apache fineract improper privilege management vulnerabilityImproper Privilege Management vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended to upgrade to versio…EPSS 1.1%29 Mar 2024

Source: NIST National Vulnerability Database (record CVE-2024-23539), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.