CVE-2026-35152

A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run reports to inject arbitrary SQL via crafted parameter values. This can be leveraged to perform unauthorized access to data beyond what the report was designed to expose. Users are recommended to upgrade to a version containing the fix.

• CWE-89

• https://github.com/apache/fineract/pull/5980Patch
• https://lists.apache.org/thread/658yddn0bpxqw2hpxnyk3vqd05bkchg9Mailing List, Vendor Advisory
• https://lists.apache.org/thread/d3bzcwsbywz7wg9zxvtlkvgmffqjyfn0Mailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/07/15/1Mailing List, Third Party Advisory

Published

Jul 15, 2026

Last Modified

Jul 15, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35145HCL DFXAnalytics is affected by a Missing HTTP Strict-Transp…3.1
• CVE-2026-35146HCL DFXServer is affected by an Unencrypted Communication vu…6.3
• CVE-2026-35147HCL DFXServer is affected by a Broken Authentication vulnera…8.2
• CVE-2026-35148HCL DFXServer is affected by a Missing Access Control vulner…6.3
• CVE-2026-35149HCL DFXServer is affected by an Authentication Bypass vulner…8.2
• CVE-2026-3515A vulnerability in the `GitHubRepository` block of the `pref…8.5
• CVE-2026-35153Dell PowerProtect Data Domain Feature Release versions 7.7.1…6.7
• CVE-2026-35154Dell PowerProtect Data Domain Feature Release versions 7.7.1…6.7
• CVE-2026-35155Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains a…7.1
• CVE-2026-35157Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectSca…9.8
• CVE-2026-35159Dell Client Platform BIOS contains an Authentication Bypass …5.3
• CVE-2026-3516The Contact List plugin for WordPress is vulnerable to Store…6.4