Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache Fineract | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 30 Oct 2026 10:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 30 Oct 2026 08:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue. | |
| Title | Apache Fineract: SQL injection vulnerability in Search API | |
| Weaknesses | CWE-89 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: apache
Published:
Updated: 2026-10-30T09:10:27.784Z
Reserved: 2026-07-20T11:41:26.801Z
Link: CVE-2026-64618
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-30T09:17:15.337
Modified: 2026-10-30T10:16:55.190
Link: CVE-2026-64618
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-30T09:30:11Z
-
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')