30 matches found
DBconfigReader
泛微ecology OAシステムのインターフェースにデータベース設定情報漏えいの脆弱性が存在する /mobile/DBconfigReader.jsp http://x.x.x.x:8090/mobile/DBconfigReader.jsp Fortify コード監査 検出 - 弱い暗号化アルゴリズム SecretKey key = SecretKeyFactory.getInstance"DES".generateSecretdks1; root@kitploit: % String conStr=Prop.getPropValue"weaver","ecology.url";...
CVE-2016-20097
Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...
CVE-2022-50997
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
CVE-2022-50997 Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
EUVD-2022-56016
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
CVE-2022-50997
The CVE-2022-50997 entry concerns Weaver (Fanwei) E-cology 8.0 and 9.0, where a SQL injection vulnerability exists in the HrmCareerApplyPerView.jsp endpoint. An unauthenticated attacker can manipulate the id parameter (via a crafted GET request) to perform UNION-based injections against a Microso...
CVE-2016-20097
CVE-2016-20097 involves Weaver (Fanwei) E-cology 8.0. A vulnerability in the SignatureDownLoad servlet allows unauthenticated remote attackers to perform a SQL injection via the markId parameter, which is concatenated into a query. This can let an attacker control the returned markPath value and ...
EUVD-2016-10910
Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...
CVE-2016-20097 Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad
Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...
PT-2026-70788
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
VulnCheck KEV: CVE-2016-20097
Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...
Exploiting Logic Asymmetry in Modern Web Application Firewalls
This research whitepaper demonstrates that even the most modern WAFs remain vulnerable to attacks exploiting logic asymmetry in HTTP protocol processing. Real-world testing on a Weaver Ecology OA system achieved a 100% bypass rate 40/40 test cases, confirming the critical severity of this...
CVE-2022-50992
Weaver Fanwei E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying file paths to the WorkflowService.getAttachment and...
CVE-2026-22679 Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint
Weaver Fanwei E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft PO...
Weaver e-cology 访问控制错误漏洞
Weaver e-cology is a collaborative management application platform developed by the Chinese company Weaver. Versions of Weaver e-cology prior to 10.0 20260312 contained an access control vulnerability. This vulnerability stemmed from unvalidated remote code execution, which could lead to the...
CVE-2024-48072
Weaver Ecology v9. was discovered to contain a SQL injection vulnerability via the component /mobilemode/Action.jsp?invoker=com.weaver.formmodel.mobile.mec.servlet.MECAction=getFieldTriggerValue==HrmResourceManager=1%3d1=1=%3d=1...
CVE-2024-48069
A vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files and control server privileges...
CVE-2024-48072
Weaver Ecology v9. was discovered to contain a SQL injection vulnerability via the component...
