Weaver E-cology: Unauthenticated SQL injection via /api/doc/out/more/list
Summary
Weaver E-cology 8.0, 9.0 and 10.0 before 10.76 contains an unauthenticated SQL injection flaw in the /api/doc/out/more/list endpoint, triggered via the elementmore parameter with srcType=2. An remote attacker can inject SQL through the doc_datefrom and doc_dateto fields and read the results via /api/ec/dev/table/counts, which allows extraction of database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19.
Affected
- Weaver E-cology 8.0, 9.0 and 10.0 prior to 10.76
- Whether versions before 8.0 are affected is unknown (the CNA range is listed as 0 to below 10.76)
Fixed in
- Update to E-cology 10.76 or later
- Fixed build numbers for the 8.0 and 9.0 branches: Unknown.
Workaround
- No vendor workaround confirmed.
- Restrict access to the E-cology web interface to VPN or trusted networks until the update is installed.
Exploitation
- Exploitation evidence first observed by Shadowserver on 2026-07-19.
- Public write-ups and a Nuclei template exist.
- CISA KEV status: Not listed according to one source, not verified.
Our recommendation
- Inventory all E-cology instances and versions, including test systems.
- Remove direct internet exposure of E-cology or restrict it to VPN or trusted networks.
- Upgrade to 10.76 or later after confirming the download on Weaver's official page.
- Review web logs for requests to the affected endpoint since 2026-07-19 and rotate database credentials if exposure is suspected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record reference: Weaver advisory www.weaver.com.cn
- VulnCheck advisory www.vulncheck.com
- Nuclei template weaver-ecology9-doc-list-sqli github.com
- Technical analysis (1diot9 blog) 1diot9.github.io
- CVE details (threatint) cve.threatint.com
- HOL Guard CVE entry hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:56.
Original description (NVD)
Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via /api/ec/dev/table/counts to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19.
NVD references (6)
- https://1diot9.github.io/2026/05/13/%E6%B3%9B%E5%BE%AEe9%E5%88%86%E6%9E%90%E6%80%9D%E8%B7%AF/
- https://blog.csdn.net/murphysec/article/details/149236904
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/weaver/weaver-ecology9-do…
- https://www.vulncheck.com/advisories/weaver-e-cology-10.76-unauthenticated-sql-injection-via-doc-out-more-list
- https://www.weaver.com.cn/cs/security/edm20250704_opiurutjvmopimdwytdc.html
- https://y4tacker.github.io/2025/07/09/year/2025/07/%E5%A6%82%E4%BD%95%E4%BB%8E%E7%81%B0%E7%9B%92%E8%A7%92%E5%…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.