27 matches found
CVE-2022-50997 Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
EUVD-2022-56016
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
CVE-2022-50997
Weaver (Fanwei) E-cology 8.0 and 9.0 contain a SQL injection in HrmCareerApplyPerView.jsp that allows unauthenticated remote attackers to extract data from the backend database by manipulating the id GET parameter. An attacker can send a single crafted GET request using UNION-based payloads throu...
CVE-2016-20097
CVE-2016-20097 affects Weaver (Fanwei) E-cology 8.0. A SQL injection vulnerability in the SignatureDownLoad servlet lets unauthenticated remote attackers inject a UNION SELECT payload via the markId parameter, concatenated unsanitized into a SQL query, enabling retrieval of files by steering the ...
CVE-2016-20097 Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad
Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...
EUVD-2016-10910
Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...
Exploiting Logic Asymmetry in Modern Web Application Firewalls
This research whitepaper demonstrates that even the most modern WAFs remain vulnerable to attacks exploiting logic asymmetry in HTTP protocol processing. Real-world testing on a Weaver Ecology OA system achieved a 100% bypass rate 40/40 test cases, confirming the critical severity of this...
CVE-2022-50992
Weaver Fanwei E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying file paths to the WorkflowService.getAttachment and...
CVE-2026-22679 Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint
Weaver Fanwei E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft PO...
Weaver e-cology 访问控制错误漏洞
Weaver e-cology is a collaborative management application platform developed by the Chinese company Weaver. Versions of Weaver e-cology prior to 10.0 20260312 contained an access control vulnerability. This vulnerability stemmed from unvalidated remote code execution, which could lead to the...
CVE-2024-48072
Weaver Ecology v9. was discovered to contain a SQL injection vulnerability via the component /mobilemode/Action.jsp?invoker=com.weaver.formmodel.mobile.mec.servlet.MECAction=getFieldTriggerValue==HrmResourceManager=1%3d1=1=%3d=1...
CVE-2024-48069
A vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files and control server privileges...
CVE-2024-48072
Weaver Ecology v9. was discovered to contain a SQL injection vulnerability via the component...
CVE-2024-48072
Weaver Ecology v9. was discovered to contain a SQL injection vulnerability via the component...
CVE-2024-48070
An issue in Weaver E-cology v. attackers construct special requests to insert remote malicious code and to trigger malicious code execution, and control server privileges...
CVE-2024-48072
Weaver Ecology v9. was discovered to contain a SQL injection vulnerability via the component...
CVE-2024-48070
CVE-2024-48070 affects Weaver E-cology. Multiple sources describe a vulnerability where attackers can craft requests to insert remote code and potentially execute code with server privileges, linked to a SQL injection issue in Weaver E‑cology v9.x. Affected component: SQL handling in Weaver E‑col...
CVE-2024-48071
CVE-2024-48071 affects E-cology/Weaver e-cology and is described as a directory traversal vulnerability that could enable an attacker to delete server files and cause permanent denial of service. Connected sources corroborate a traversal flaw but do not provide concrete exploit details, affected ...