GCVE - cpe:2.3:a:weaver:e-cology:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:weaver:e-cology:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Weaver (`d1eebdd6-dd11-5049-a599-082708582d07`)
Product	E Cology (`42de33b5-225f-5e72-b918-e43cedcb3769`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-22679`	vulnerable	2026-06-08 07:51:13.575811	Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint CRITICAL (9.8) Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC). Published: 2026-04-07T12:51:22.789Z Updated: 2026-07-14T15:53:29.433Z Open on db.gcve.eu Reference links https://www.weaver.com.cn/cs/securityDownload.html# https://h4cker.zip/post/d5d211/ https://ti.qianxin.com/vulnerability/notice-detail/1760 https://www.vulncheck.com/advisories/weaver-e-cology-unauthenticated-rce-via-dubboapi-debug-endpoint	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-34038`	vulnerable	2026-06-08 07:19:02.087602	Weaver E-cology SQL Injection A SQL injection vulnerability exists in Weaver E-cology 8.0 via the getdata.jsp endpoint. The application directly passes unsanitized user input from the sql parameter into a database query within the getSelectAllIds(sql, type) method, reachable through the cmd=getSelectAllId workflow in the AjaxManager. This allows unauthenticated attackers to execute arbitrary SQL queries, potentially exposing sensitive data such as administrator password hashes. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC. Published: 2025-06-24T01:06:35.820Z Updated: 2026-05-14T02:07:26.667Z Open on db.gcve.eu Reference links https://www.cnblogs.com/0day-li/p/14637680.html https://www.cnvd.org.cn/flaw/show/CNVD-2021-33202 https://weaver.com.co/products/ecology/ https://vulncheck.com/advisories/fanwei-ecology-sql-injection	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-7704`	vulnerable	2026-06-08 06:58:23.187584	Weaver e-cology Source Code ecology_dev.zip information disclosure MEDIUM (5.3) A vulnerability was found in Weaver e-cology 8. It has been classified as problematic. Affected is an unknown function of the file /cloudstore/ecode/setup/ecology_dev.zip of the component Source Code Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Published: 2024-08-12T20:31:03.873Z Updated: 2024-08-13T14:08:11.976Z Open on db.gcve.eu Reference links https://vuldb.com/?id.274182 https://vuldb.com/?ctiid.274182 https://vuldb.com/?submit.385494 https://github.com/Dreamy-elfland/240731	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-48072`	vulnerable	2026-06-08 06:48:13.605200	Details available Weaver Ecology v9.* was discovered to contain a SQL injection vulnerability via the component /mobilemode/Action.jsp?invoker=com.weaver.formmodel.mobile.mec.servlet.MECAction&action=getFieldTriggerValue&searchField=*&fromTable=HrmResourceManager&whereClause=1%3d1&triggerCondition=1&expression=%3d&fieldValue=1. Published: 2024-11-19T00:00:00.000Z Updated: 2024-11-21T16:31:38.408Z Open on db.gcve.eu Reference links https://github.com/stuven1989/TemporaryGuild/blob/main/files/exp-eng4.pdf https://gist.github.com/CoinIsMoney/8ca1f2bf2e0399724c698327f2da8579	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-48070`	vulnerable	2026-06-08 06:48:13.604423	Details available An issue in Weaver E-cology v. attackers construct special requests to insert remote malicious code and to trigger malicious code execution, and control server privileges Published: 2024-11-19T00:00:00.000Z Updated: 2024-11-21T16:36:00.273Z Open on db.gcve.eu Reference links https://github.com/stuven1989/TemporaryGuild/blob/main/files/exp2-eng.pdf https://gist.github.com/CoinIsMoney/ec863c35dfd05c7deea2afea11bf2446	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-48069`	vulnerable	2026-06-08 06:48:13.602352	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-3793`	vulnerable	2026-06-08 06:09:40.558347	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-2806`	vulnerable	2026-06-08 06:02:43.035965	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.