{"id":"CVE-2026-64618","published":"2026-10-30T09:17:15.337","lastModified":"2026-10-30T17:07:53.700","description":"Improper Neutralization of Special Elements used in an SQL Command (\"SQL Injection\") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/apache/fineract/pull/6153","tags":[]},{"url":"https://lists.apache.org/thread/s8orckszcd9x4d1qsloc046ppf5q9oc7","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/4","tags":[]}],"exploitRefs":[{"url":"https://github.com/apache/fineract/pull/6153","tags":[]}],"hasPoc":true,"ai":null}