{"id":"CVE-2026-64618","aliases":[],"cve":{"records":[{"id":"CVE-2026-64618","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-20T11:41:26.801Z","published":"2026-10-30T08:29:02.904Z","modified":"2026-10-30T09:10:27.784Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-10-30T08:29:02.904Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-10-30T09:10:27.784Z"}],"references":[{"url":"https://github.com/apache/fineract/pull/6153","tags":["patch"],"source":"apache"},{"url":"https://lists.apache.org/thread/s8orckszcd9x4d1qsloc046ppf5q9oc7","tags":["vendor-advisory"],"source":"apache"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/4","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache Fineract: SQL injection vulnerability in Search API","titleSource":"apache","descriptionSource":"apache","description":"Improper Neutralization of Special Elements used in an SQL Command (\"SQL Injection\") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.","score":null,"severity":"unknown","published":"2026-10-30T08:29:02.904Z","modified":"2026-10-30T09:10:27.784Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache Fineract","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.15.0","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-64618"}],"remediation":[],"references":["https://github.com/apache/fineract/pull/6153","https://lists.apache.org/thread/s8orckszcd9x4d1qsloc046ppf5q9oc7","http://www.openwall.com/lists/oss-security/2026/10/30/4"],"sources":[{"name":"CVE","id":"CVE-2026-64618","modified":"2026-10-30T09:10:27.784Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-64618"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-30T09:31:07.265Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:00:31.626Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T08:45:31.548Z","attemptedAt":"2026-10-30T08:45:31.548Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T08:45:31.237Z","attemptedAt":"2026-10-30T08:45:31.237Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-30T08:45:31.550Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T08:45:31.546Z","attemptedAt":"2026-10-30T08:45:31.546Z"}],"evidence":[],"aiSummary":null}