EUVD-2025-211171

Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through docdatefrom/docdateto fields and read results via /api/ec/dev/table/count...

CVE-2025-71434

Weaver E-cology versions 8.0 , 9.0 , and 10.0 (prior to 10.76 ) are vulnerable to an unauthenticated SQL injection in the /api/doc/out/more/list endpoint. The flaw exists via the elementmore parameter when srcType=2, allowing attackers to inject SQL through the doc_datefrom and doc_dateto fields....