Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Weaver E‑cology allows remote data theft via crafted request

CVE-2025-71434 · published 13 days ago
Summary

Versions 8.0, 9.0 and any 10.x before 10.76 of Weaver E‑cology let anyone on the internet send specially formed web requests that cause the system’s database to reveal its contents. This can expose sensitive business information stored in the application. Upgrade to version 10.76 or later, or apply the vendor’s patch, to stop the problem.

What to do
  • Update weaver network co., ltd. e-cology to version 10.76 or later.
Affected software
VendorProductAffected versions
weaver network co., ltd. e-cology < 10.76
Original advisory text
Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list
Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via /api/ec/dev/table/counts to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published22 Oct 2026
Updated4 Nov 2026
First seen22 Oct 2026
Sources
CVE-2025-71434 · NVD
CVE-2025-71434 · MITRE
Track software like this
Free during beta