Dashboard / CVE-2026-35152

CVE-2026-35152

HIGH
MEDIUM Priority: 0.29 BB Relevance: 68/100
Published: 2026-07-15 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: High

Description

A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run reports to inject arbitrary SQL via crafted parameter values. This can be leveraged to perform unauthorized access to data beyond what the report was designed to expose. Users are recommended to upgrade to a version containing the fix.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
apache fineract < 1.15.0

References & Advisories (4)

Bug Bounty Relevance

68 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

3.28%
Raw Score 0.032810
Percentile 88.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.03281
2026-10-28
0.03281

Intelligence Sources

nvd ref →

External Links