CVE-2026-64618

{"id": "CVE-2026-64618", "cveTags": [], "metrics": {}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Fineract", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.15.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-30T09:17:15.337", "references": [{"url": "https://github.com/apache/fineract/pull/6153", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/s8orckszcd9x4d1qsloc046ppf5q9oc7", "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/30/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command (\"SQL Injection\") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition\u00a0parameter of the /fineract-provider/api/v1/search/advance\u00a0HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue."}], "lastModified": "2026-10-30T17:07:53.700", "sourceIdentifier": "security@apache.org"}