CVE-2022-50997 debrief based on the supplied source corpus. Weaver (Fanwei) E-cology 8.0 and 9.0 contain a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint. This vulnerability allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. The vulnerability is potentially remediated in software version 10.53 or 10.54. E [truncated]
HIGHWeaver Network Co., Ltd.CVE published 2026-08-11
CVE-2016-20097 Weaver (Fanwei) E-cology 8.0 SQL injection vulnerability allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter. This enables attackers to control the markPath value, causing the servlet to read and stream back arbitrary files accessible to the application server process, including sensitive configuration files conta [truncated]
CRITICALWeaver Network Co., Ltd.CVE published 2026-08-07
CVE-2022-4995 is a critical file upload vulnerability in Weaver E-cology 9.0 versions prior to 10.52. This vulnerability allows remote, unauthenticated attackers to upload arbitrary files, including JSP webshells, potentially leading to remote code execution under the privileges of the application server process. The vulnerability was first reported by the Shadowserver Foundation on 2023-10-14 (UTC). Defe [truncated]
