CVE-2025-71434: Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list
Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through docdatefrom/docdateto fields and read results via /api/ec/dev/table/counts to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Weaver E-cology 8.0, 9.0, and 10.0 releases prior to 10.76 are affected. The vulnerable endpoint is /api/doc/out/more/list.
Does exploitation require authentication or user interaction?
No. The issue is unauthenticated, has no required privileges, and does not require user interaction; it can be reached over the network.
What request elements are involved in exploitation?
The injection path involves the elementmore parameter when srcType=2, with SQL injected through the doc_datefrom and doc_dateto fields. Database results can be read through /api/ec/dev/table/counts.
Has this vulnerability been exploited in the wild?
Yes. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19.