Weaver Network Co., Ltd. vulnerabilities

Products

• E-cology 5
• E-cology 8.0 2
• E-cology 9.0 2
• E-office 1

Latest Weaver Network Co., Ltd. CVEs

Newest publication first

1. CVE-2025-71434 Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list

   Published 2026-10-22

   High·CVSS 8.8 EPSS 0.32%

   Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via /api...

2. CVE-2021-48013 Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload

   Published 2026-10-22

   High·CVSS 8.7 EPSS 0.74%

   Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory traversal sequences in fpath to re...

3. CVE-2019-25776 Weaver E-cology SQL Injection via SyncUserInfo.jsp

   Published 2026-09-18

   High·CVSS 8.7 EPSS 0.60%

   Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter con...

4. CVE-2022-50997 Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp

   Published 2026-08-11

   High·CVSS 8.7 EPSS 0.62%

   Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single...

5. CVE-2016-20097 Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad

   Published 2026-08-11

   High·CVSS 8.7 EPSS 0.63%

   Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQ...

6. CVE-2022-4995 Weaver E-cology 9.0 File Upload RCE via uploaderOperate.jsp

   Published 2026-08-07

   Critical·CVSS 9.3 EPSS 1.2%

   Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-data POST request to /workrelate/plan/util/uploaderOperate.js...

7. CVE-2022-50992 Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet

   Published 2026-04-30

   High·CVSS 8.7 EPSS 0.71%

   Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying file paths to the WorkflowService.getAttachme...

8. CVE-2022-50993 Weaver E-office < 10.0_20221201 Unauthenticated Arbitrary File Read via XmlRpcServlet

   Published 2026-04-30

   Critical·CVSS 9.3 EPSS 0.77%

   Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguise...

9. CVE-2026-22679 Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint

   Published 2026-04-07

   Critical·CVSS 9.3 EPSS 20.7%

   Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Att...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.