59 matches found
DBconfigReader
Database Configuration Information Disclosure Vulnerability in the Weaver ecology OA System Interface /mobile/DBconfigReader.jsp http://x.x.x.x:8090/mobile/DBconfigReader.jsp Fortify Code Audit Detected - Weak Encryption Algorithm SecretKey key =...
cve-2023-42413
cve-2023-42413 ecology9sql...
com.github.liuzhenghui:weaver-ecology-parent (>=9.00.2110.07.220316, <=9.00.2112.03.220528) potentially affected by CVE-2026-65829 via net.sf.mpxj:mpxj (7.4.3)
net.sf.mpxj:mpxj MAVEN version 7.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on net.sf.mpxj:mpxj and may be impacted: - com.github.liuzhenghui:weaver-ecology-parent =9.00.2110.07.220316, =9.00.2112.03.220528 Source cves: CVE-2026-65829 Source...
CVE-2016-20097
Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...
CVE-2022-50997
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
CVE-2022-50997 Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
EUVD-2022-56016
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
CVE-2022-50997
The CVE-2022-50997 entry concerns Weaver (Fanwei) E-cology 8.0 and 9.0, where a SQL injection vulnerability exists in the HrmCareerApplyPerView.jsp endpoint. An unauthenticated attacker can manipulate the id parameter (via a crafted GET request) to perform UNION-based injections against a Microso...
EUVD-2016-10910
Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...
CVE-2016-20097 Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad
Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...
CVE-2016-20097
CVE-2016-20097 involves Weaver (Fanwei) E-cology 8.0. A vulnerability in the SignatureDownLoad servlet allows unauthenticated remote attackers to perform a SQL injection via the markId parameter, which is concatenated into a query. This can let an attacker control the returned markPath value and ...
PT-2026-70788
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
VulnCheck KEV: CVE-2016-20097
Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...
CVE-2022-4995
Weaver Fanwei E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-data POST request to /workrelate/plan/util/uploaderOperate.jsp with arbitrary...
Ecology OA CheckServer - SQL Injection Detection
Ecology OA system improperly filters incoming data from users, resulting in a SQL injection vulnerability. Remote and unauthenticated attackers can use this vulnerability to conduct SQL injection attacks and steal sensitive database information. !/usr/bin/env python3 -- coding: utf-8 -- """Ecolog...
Exploiting Logic Asymmetry in Modern Web Application Firewalls
This research whitepaper demonstrates that even the most modern WAFs remain vulnerable to attacks exploiting logic asymmetry in HTTP protocol processing. Real-world testing on a Weaver Ecology OA system achieved a 100% bypass rate 40/40 test cases, confirming the critical severity of this...
CVE-2022-50992
Weaver Fanwei E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying file paths to the WorkflowService.getAttachment and...
EUVD-2022-55964
Weaver Fanwei E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying file paths to the WorkflowService.getAttachment and...
CVE-2026-22679 Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint
Weaver Fanwei E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft PO...
Weaver e-cology 访问控制错误漏洞
Weaver e-cology is a collaborative management application platform developed by the Chinese company Weaver. Versions of Weaver e-cology prior to 10.0 20260312 contained an access control vulnerability. This vulnerability stemmed from unvalidated remote code execution, which could lead to the...