Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

8 records

Vendor: Weaver Network Co., Ltd. Clear all filters
TI-2025-43962 CVE-2025-71434 · GHSA-gqhm-9jqr-x4r6

Unauthenticated SQL injection in Weaver E-cology

Priority HIGH 77

Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00318 Published 2026-10-22 Fixed in 10.76 CWE-89
TI-2021-22764 CVE-2021-48013 · GHSA-ggh3-mmrr-r9c4

Unauthenticated path traversal in Weaver E-cology reads server files

Priority HIGH 77

Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00736 Published 2026-10-22 No fix listed CWE-22
TI-2019-15817 CVE-2019-25776 · GHSA-xwcr-fg7m-3jxv

Weaver E-cology SQL Injection via SyncUserInfo.jsp

Priority HIGH 77

Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00599 Published 2026-09-18 No fix listed CWE-89
TI-2022-26436 CVE-2022-50997 · GHSA-p597-c7c2-qj48

Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp

Priority HIGH 77

Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by ma…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00621 Published 2026-08-11 Fixed in 10.53, 10.54 CWE-89
TI-2016-09273 CVE-2016-20097 · GHSA-8r52-43hm-h433

Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad

Priority HIGH 77

Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markI…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00632 Published 2026-08-11 No fix listed CWE-89
TI-2022-04582 CVE-2022-4995 · GHSA-ffmq-85gq-q6f3

Weaver E-cology 9.0 File Upload RCE via uploaderOperate.jsp

Priority HIGH 81

Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-d…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01175 Published 2026-08-07 Fixed in 10.52 CWE-434
TI-2022-26433 CVE-2022-50992 · GHSA-vgv3-vw5h-8gfj

Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet

Priority MEDIUM 45

Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers to read arbitrary file…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00705 Published 2026-04-30 Fixed in 10.52 CWE-22
TI-2022-26434 CVE-2022-50993 · GHSA-g99j-cq2q-3xrv

Weaver E-office < 10.0_20221201 Unauthenticated Arbitrary File Read via XmlRpcServlet

Priority HIGH 81

Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending m…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00774 Published 2026-04-30 Fixed in 10.0_20221201 CWE-434