Skip to content
OpenAdvisories

Vendor

Weaver Network

9 known vulnerabilities.

Products

E-cology 5 E-cology 8.0 2 E-cology 9.0 2 E-office 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.2
    CVE-2025-71434

    Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list

    Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and …

    Weaver Network E-cology
  • High 7.5
    CVE-2021-48013

    Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload

    Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory traversal seq…

    Weaver Network E-cology
  • High 7.5
    CVE-2019-25776

    Weaver E-cology SQL Injection via SyncUserInfo.jsp

    Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass s…

    Weaver Network E-cology
  • High 7.5
    CVE-2022-50997

    Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp

    Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attack…

    Weaver Network E-cology 8.0 E-cology 9.0
  • High 7.5
    CVE-2016-20097

    Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad

    Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated …

    Weaver Network E-cology 8.0
  • High 7.5
    CVE-2022-50992

    Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet

    Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying file paths to the Workfl…

    Weaver Network E-cology