A SQL Injection vulnerability exists in Apache Fineract through version 1.15.0. It affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint due to improper neutralization of special elements in SQL commands. This allows attackers to inject malicious SQL code. The issue is fixed in version 1.16.1.