CVE-2026-64618

{
  "etk_id": "ETK-2026-3059",
  "cve_id": "CVE-2026-64618",
  "display_id": "CVE-2026-64618",
  "ghsa_id": "GHSA-3536-74c2-mgrr",
  "euvd_id": "EUVD-2026-113752",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in Apache Fineract advanced search API",
  "summary": "Apache Fineract through 1.15.0 is affected by SQL injection in an input parameter of the advanced search API. An attacker able to submit requests to the affected endpoint may inject SQL commands because the parameter is not adequately neutralized.",
  "mitigation": "Upgrade Apache Fineract to version 1.16.1. Restrict access to the advanced search API until the upgrade is complete.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Fineract",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.15.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Apache Fineract",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 96.76569081666666,
  "t0_at": "2026-10-30T08:29:02.904000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-30T08:29:02.904000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-30T08:29:02.904000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64618"
    }
  }
}