{"id":"CVE-2026-64618","aliases":["EUVD-2026-113752","GHSA-3536-74c2-mgrr"],"status":"published","title":"Apache Fineract: SQL injection vulnerability in Search API","description":"Improper Neutralization of Special Elements used in an SQL Command (\"SQL Injection\") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00624,"percentile":0.50205,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-10-30T08:29:02Z","modified":"2026-11-04T02:48:00Z","products":[{"vendor":"apache","product":"fineract"},{"vendor":"apache software foundation","product":"apache fineract"}],"references":[{"url":"https://github.com/apache/fineract/pull/6153","tags":["patch","Issue Tracking","Patch","fix"]},{"url":"https://lists.apache.org/thread/s8orckszcd9x4d1qsloc046ppf5q9oc7","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/4","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64618","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3536-74c2-mgrr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64618.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-64618","title":"Apache Fineract: SQL injection vulnerability in Search API","description":"Improper Neutralization of Special Elements used in an SQL Command (\"SQL Injection\") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.","status":"published","published":"2026-10-30T08:29:02.904Z","modified":"2026-11-06T16:30:59.535Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-06T17:28:53.22449Z"}],"euvd":[{"id":"EUVD-2026-113752","description":"Improper Neutralization of Special Elements used in an SQL Command (\"SQL Injection\") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.","status":"published","published":"2026-10-30T08:29:02Z","modified":"2026-11-06T16:30:59Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-06T18:05:43.085588Z"}],"ghsa":[{"id":"GHSA-3536-74c2-mgrr","title":"Improper Neutralization of Special Elements used in an SQL Command (\"SQL Injection\")...","description":"Improper Neutralization of Special Elements used in an SQL Command (\"SQL Injection\") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.","status":"published","published":"2026-10-30T09:31:26Z","modified":"2026-11-02T15:32:32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T18:00:16.184668Z"}],"nvd":[{"id":"CVE-2026-64618","description":"Improper Neutralization of Special Elements used in an SQL Command (\"SQL Injection\") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.","status":"published","published":"2026-10-30T09:17:15.337Z","modified":"2026-11-06T17:19:16.813Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-06T20:01:15.785017Z"}],"osv":[{"id":"CVE-2026-64618","title":"Apache Fineract: SQL injection vulnerability in Search API","description":"Improper Neutralization of Special Elements used in an SQL Command (\"SQL Injection\") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.","status":"published","published":"2026-10-30T08:29:02.904Z","modified":"2026-11-08T07:14:01.481883378Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-07T03:08:08.86544Z"}]}}