Skip to content
OpenAdvisories

Vendor

Weaver

11 known vulnerabilities.

Weaver at a glance

Last 12 months
1
Critical · all time
0
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202510
Jul 202500
Jun 202510
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

E-cology 4 E-Office 3 OA 2 e-Bridge 1 E-Mobile Mobile Management Platform 1
All Critical High Medium Low Exploited only Public exploit

11 results · Feed

  • High 7.5
    CVE-2020-37278

    Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile

    Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the host system by supplying a file: URL to the downloadUrl parameter of the saveYZJFile endpoint. Attackers can exploit th…

    Weaver e-Bridge
  • Low 3.5
    CVE-2025-9590

    Weaver E-Mobile Mobile Management Platform cross site scripting

    A vulnerability was identified in Weaver E-Mobile Mobile Management Platform up to 20250813. Affected by this vulnerability is an unknown functionality. The manipulation of the argument gohome leads to cross site scripting. The attack can be initiated remotel…

    Weaver E-Mobile Mobile Management Platform
  • High 8.7
    CVE-2025-34038

    Weaver E-cology SQL Injection

    A SQL injection vulnerability exists in Weaver E-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the c…

    Weaver E-cology
  • Medium 5.3
    CVE-2024-7704

    Weaver e-cology Source Code ecology_dev.zip information disclosure

    A vulnerability was found in Weaver e-cology 8. It has been classified as problematic. Affected is an unknown function of the file /cloudstore/ecode/setup/ecology_dev.zip of the component Source Code Handler. The manipulation leads to information disclosure. …

    Weaver E-cology
  • Medium 5.5
    CVE-2023-3793

    Weaver e-cology HTTP POST Request filelFileDownloadForOutDoc.class sql injection

    A vulnerability was found in Weaver e-cology. It has been rated as critical. This issue affects some unknown processing of the file filelFileDownloadForOutDoc.class of the component HTTP POST Request Handler. The manipulation of the argument fileid with the i…

    Weaver E-cology
  • Medium 5.5
    CVE-2023-2806

    Weaver e-cology API RequestInfoByXml xml external entity reference

    A vulnerability classified as problematic was found in Weaver e-cology up to 9.0. Affected by this vulnerability is the function RequestInfoByXml of the component API. The manipulation leads to xml external entity reference. The associated identifier of this …

    Weaver E-cology
  • Medium 5.3
    CVE-2023-2766 EPSS 54%

    Weaver OA jx2_config.ini file access

    A vulnerability was found in Weaver OA 9.5 and classified as problematic. This issue affects some unknown processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini. The manipulation leads to files or directories accessible. The atta…

    Weaver OA
  • Medium 4.3
    CVE-2023-2765

    Weaver OA downfile.php absolute path traversal

    A vulnerability has been found in Weaver OA up to 9.5 and classified as problematic. This vulnerability affects unknown code of the file /E-mobile/App/System/File/downfile.php. The manipulation of the argument url leads to absolute path traversal. The attack …

    Weaver OA
  • Medium 6.3
    CVE-2023-2648 EPSS 28%

    Weaver E-Office uploadify.php unrestricted upload

    A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uploadify/uploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. It is possible to initi…

    Weaver E-Office
  • Medium 6.3
    CVE-2023-2647

    Weaver E-Office File Upload utility_all.php command injection

    A vulnerability was found in Weaver E-Office 9.5 and classified as critical. Affected by this issue is some unknown functionality of the file /webroot/inc/utility_all.php of the component File Upload Handler. The manipulation leads to command injection. The a…

    Weaver E-Office
  • High 7.3
    CVE-2023-2523 Public exploit EPSS 33%

    Weaver E-Office unrestricted upload

    A vulnerability was found in Weaver E-Office 9.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file App/Ajax/ajax.php?action=mobile_upload_save. The manipulation of the argument upload_quwan leads to unrestricted …

    Weaver E-Office