Weaver Network vulnerabilities
We track 6 vulnerabilities in Weaver Network products across 4 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 22, 2026.
Latest Weaver Network vulnerabilities
- 8.2 High severity
E-cology: Improper Neutralization of Special Elements used in an SQL Command
Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and r
- 7.5 High severity
E-cology 9.0: Improper Neutralization of Special Elements used in an SQL Command
Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attacke
- 9.8 Critical severity
E-cology 9.0: Unrestricted Upload of File with Dangerous Type
Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-data POST request to /workrelate/plan/uti
- 9.8 Critical severity
E-office: Unrestricted Upload of File with Dangerous Type
Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary fi
- 7.5 High severity
E-cology: Improper Limitation of a Pathname to a Restricted Directory
Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying file paths to the Workflo
- 9.8 Critical severity
E-cology: Missing Authentication for Critical Functionality
Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debu