Weaver Network Co Ltd
Monthly
Unauthenticated SQL injection in Weaver E-cology 8.0, 9.0, and 10.0 before 10.76 allows remote attackers to inject SQL through the doc_datefrom and doc_dateto fields of the /api/doc/out/more/list endpoint when srcType=2 and elementmore is used, then read query results through /api/ec/dev/table/counts to extract database information. The assessed vector requires only network reachability, with no privileges or user interaction, and instances upgraded to 10.76 or later are not affected. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19, and a public PoC reference exists; it is not verified as working exploit code.
Unauthenticated remote code execution in Weaver E-cology 10.0 (pre-20260312) allows attackers to execute arbitrary system commands via exposed debug functionality at /papi/esearch/data/devops/dubboApi/debug/method. Attackers exploit this by sending crafted POST requests with malicious interfaceName and methodName parameters to invoke command-execution helpers. Confirmed actively exploited (CISA KEV) with exploitation first observed by Shadowserver Foundation on March 31, 2026. Publicly available exploit code exists (h4cker.zip PoC), CVSS 9.8 (Critical), EPSS data not provided but real-world exploitation confirmed.
Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unauthenticated SQL injection in Weaver E-cology 8.0, 9.0, and 10.0 before 10.76 allows remote attackers to inject SQL through the doc_datefrom and doc_dateto fields of the /api/doc/out/more/list endpoint when srcType=2 and elementmore is used, then read query results through /api/ec/dev/table/counts to extract database information. The assessed vector requires only network reachability, with no privileges or user interaction, and instances upgraded to 10.76 or later are not affected. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19, and a public PoC reference exists; it is not verified as working exploit code.
Unauthenticated remote code execution in Weaver E-cology 10.0 (pre-20260312) allows attackers to execute arbitrary system commands via exposed debug functionality at /papi/esearch/data/devops/dubboApi/debug/method. Attackers exploit this by sending crafted POST requests with malicious interfaceName and methodName parameters to invoke command-execution helpers. Confirmed actively exploited (CISA KEV) with exploitation first observed by Shadowserver Foundation on March 31, 2026. Publicly available exploit code exists (h4cker.zip PoC), CVSS 9.8 (Critical), EPSS data not provided but real-world exploitation confirmed.
Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.