Exploiting Logic Asymmetry in Modern Web Application Firewalls

This research whitepaper demonstrates that even the most modern WAFs remain vulnerable to attacks exploiting logic asymmetry in HTTP protocol processing. Real-world testing on a Weaver Ecology OA system achieved a 100% bypass rate 40/40 test cases, confirming the critical severity of this...

CVE-2022-50992

Weaver Fanwei E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying file paths to the WorkflowService.getAttachment and...

CVE-2026-22679 Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint

Weaver Fanwei E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft PO...

Weaver e-cology 访问控制错误漏洞

Weaver e-cology is a collaborative management application platform developed by the Chinese company Weaver. Versions of Weaver e-cology prior to 10.0 20260312 contained an access control vulnerability. This vulnerability stemmed from unvalidated remote code execution, which could lead to the...

CVE-2024-48072

Weaver Ecology v9. was discovered to contain a SQL injection vulnerability via the component /mobilemode/Action.jsp?invoker=com.weaver.formmodel.mobile.mec.servlet.MECAction=getFieldTriggerValue==HrmResourceManager=1%3d1=1=%3d=1...

CVE-2024-48072

Weaver Ecology v9. was discovered to contain a SQL injection vulnerability via the component...

CVE-2024-48072

Weaver Ecology v9. was discovered to contain a SQL injection vulnerability via the component...

CVE-2024-48070

An issue in Weaver E-cology v. attackers construct special requests to insert remote malicious code and to trigger malicious code execution, and control server privileges...

CVE-2024-48069

A vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files and control server privileges...

CVE-2024-48069

Weaver E-cology (Weaver E-cology) is affected, specifically version 9.. The vulnerability stems from race conditions that allow bypassing security controls, enabling the upload of malicious files and potential control of server privileges. A related remote code execution issue is reported in the ...

CVE-2024-48069

A vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files and control server privileges...

CVE-2024-48072

CVE-2024-48072 affects Weaver Ecology v9., with a SQL injection vulnerability in the web component "/mobilemode/Action.jsp?invoker=com.weaver.formmodel.mobile.mec.servlet.MECAction&action=getFieldTriggerValue&searchField= &fromTable=HrmResourceManager&whereClause=1%3d1&triggerCondition=1&expressi...

CVE-2024-48072

Weaver Ecology v9. was discovered to contain a SQL injection vulnerability via the component...

CVE-2024-48070

An issue in Weaver E-cology v. attackers construct special requests to insert remote malicious code and to trigger malicious code execution, and control server privileges...

CVE-2024-48072

Weaver Ecology v9. was discovered to contain a SQL injection vulnerability via the component...

CVE-2024-48070

CVE-2024-48070 affects Weaver E-cology. Multiple sources describe a vulnerability where attackers can craft requests to insert remote code and potentially execute code with server privileges, linked to a SQL injection issue in Weaver E‑cology v9.x. Affected component: SQL handling in Weaver E‑col...

CVE-2024-48071

CVE-2024-48071 affects E-cology/Weaver e-cology and is described as a directory traversal vulnerability that could enable an attacker to delete server files and cause permanent denial of service. Connected sources corroborate a traversal flaw but do not provide concrete exploit details, affected ...

CVE-2024-48071

E-cology has a directory traversal vulnerability. An attacker can exploit this vulnerability to delete the server directory, causing the server to permanently deny service...

PT-2023-2925

Name of the Vulnerable Software and Affected Versions Weaver e-cology versions up to 9.0 Description A problematic vulnerability was found in the RequestInfoByXml function of the API component, leading to xml external entity reference. This issue is related to incorrect restriction of XML links t...

com.github.liuzhenghui:weaver-ecology-parent (>=9.00.2110.07.220316 <=9.00.2112.03.220528) potentially affected by CVE-2020-25020 via net.sf.mpxj:mpxj (=7.4.3)

net.sf.mpxj:mpxj MAVEN version =7.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on net.sf.mpxj:mpxj and may be impacted: - com.github.liuzhenghui:weaver-ecology-parent =9.00.2110.07.220316, =9.00.2112.03.220528 Source cves: CVE-2020-25020 Source...