CVE-2026-64618Not scored
Apache Fineract: SQL injection vulnerability in Search API
Apache Software Foundation · Apache Fineract
Not in CISA KEVVendor fix available
0.2%probability of exploitation in the next 30 days
13th percentile
050100
Higher than 13% of scored CVEs
Not scored yet. NVD has not published a CVSS score.
DescriptionNVD
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 3 Nov.
- Apache fixes eight high risk flaws across three projectsSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.