As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-64618: Apache Fineract: SQL injection vulnerability in Search API
A SQL injection vulnerability exists in Apache Fineract through version 1.15.0 affecting the outStandingAmountPercentageCondition parameter in the /fineract-provider/api/v1/search/advance HTTP application programming interface (API) endpoint. The flaw results from insufficient input validation, allowing attackers to inject malicious SQL commands.
Why it matters: Organizations running Apache Fineract up to 1.15.0 are at immediate risk of unauthorized data access and manipulation through the search API; patching or upgrading is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-64618: Apache Fineract: SQL injection vulnerability in Search API
A SQL injection vulnerability exists in Apache Fineract through version 1.15.0 affecting the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP application programming interface (API) endpoint. The flaw stems from improper neutralization of special elements in SQL commands, allowing attackers to inject malicious queries.
Why it matters: Organizations running Fineract through 1.15.0 face remote code execution and data exfiltration risk through the search API; patches and upgrade planning should begin immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-64618: Apache Fineract: SQL injection vulnerability in Search API
A SQL injection vulnerability in Apache Fineract through version 1.15.0 affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP endpoint. The flaw allows attackers to inject malicious SQL commands due to insufficient input validation. Fineract administrators should prioritize patching affected versions immediately.
Why it matters: Organizations running Apache Fineract through 1.15.0 face direct risk of database compromise through unauthenticated SQL injection in the search application programming interface (API); apply available patches or disable the affected endpoint.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-64618: Apache Fineract: SQL injection vulnerability in Search API
Apache Fineract through version 1.15.0 contains a SQL injection vulnerability in the Search application programming interface (API) endpoint's outStandingAmountPercentageCondition parameter due to insufficient input validation. An unauthenticated attacker with network access could exploit this flaw to execute arbitrary SQL commands.
Why it matters: Organizations deploying Apache Fineract 1.15.0 or earlier face direct database compromise risk and must patch immediately or restrict API access until an update is available.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-64618: Apache Fineract: SQL injection vulnerability in Search API
Apache Fineract through version 1.15.0 contains a SQL injection vulnerability in the Search application programming interface (API)'s outStandingAmountPercentageCondition parameter, allowing attackers to execute arbitrary SQL commands. The flaw stems from improper input validation on the /fineract-provider/api/v1/search/advance HTTP endpoint.
Why it matters: Organizations running Fineract up to 1.15.0 face remote code execution risk if this endpoint is exposed; upgrade immediately and validate input filtering on all search parameters.
- Source published
- First seen by Cybersecurity Tracker