https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 07:52:50 +0000 https://vulnerability.circl.lu/vuln/cve-2026-57821 <p><strong>Affected:</strong> Apache Software Foundation Apache Fineract</p> <p>A SQL Injection vulnerability exists in Apache Fineract&#39;s Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to inject arbitrary SQL via a crafted orderBy value. This is a bypass of the ColumnValidator fix introduced for CVE-2024-32838, which does not detect bare subqueries in the ORDER BY position. This can be leveraged to perform time-based blind SQL injection for data exfiltration. Because the injected query blocks the database connection for its full duration, concurrent exploitation can exhaust the application&#39;s database connection pool, resulting in denial of service for other users. Users are recommended to upgrade to a version containing the fix.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Fineract</p> <p>A SQL Injection vulnerability exists in Apache Fineract&#39;s Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to inject arbitrary SQL via a crafted orderBy value. This is a bypass of the ColumnValidator fix introduced for CVE-2024-32838, which does not detect bare subqueries in the ORDER BY position. This can be leveraged to perform time-based blind SQL injection for data exfiltration. Because the injected query blocks the database connection for its full duration, concurrent exploitation can exhaust the application&#39;s database connection pool, resulting in denial of service for other users. Users are recommended to upgrade to a version containing the fix.</p> https://vulnerability.circl.lu/vuln/cve-2026-57821