CVE-2026-64618

CriticalCVSS 9.8/10Last modified Nov 6, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Fineract	<= 1.15.0

References

Timeline

Published: Oct 30, 2026
Last modified: Nov 6, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-646197.5FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumve CVE-2026-646209.1FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The fun CVE-2026-646217.3FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (cli CVE-2026-646227.5Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the Appro CVE-2026-646238.6Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verif CVE-2026-646247.8FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser sur CVE-2026-646259.8AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowin CVE-2026-646266.4AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-UR CVE-2026-646276.9Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL CVE-2026-646285.4Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches pay CVE-2026-646297.8A vulnerability has been identified in Parasolid V38.0 (All versions < V38.0.235), Parasolid V38.1 (All versions < V38.1.230), Simcenter Fem CVE-2026-646305.3A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link.