E-cology vulnerabilities

3 known vulnerabilities in E-cology from Weaver Network. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  E-cology: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-71434Oct 22, 2026Weaver Network

  Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and r

• 7.5 High severity

  E-cology: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2022-50992Apr 30, 2026Weaver Network

  Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying file paths to the Workflo

• 9.8 Critical severity

  E-cology: Missing Authentication for Critical Functionality

  CVE-2026-22679Apr 7, 2026Weaver NetworkEPSS 20.7%

  Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debu