PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-71434 Weaver Network Co., Ltd. CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-22T10:57:38.815Z and has not been modified since then. Weaver E-cology versions prior to 10.76 contain an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. This vulnerability allows attackers to inject SQL through doc_datefrom/doc_dateto fields and read results via /api/ec/dev/table/counts to extract database information. Defenders should assess exposure and prioritize verification of existing compensating controls.

Vendor
Weaver Network Co., Ltd.
Product
E-cology
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-23
Advisory published
2026-10-22
Advisory updated
2026-10-23

Who should care

Defenders responsible for Weaver E-cology deployments should assess exposure and prioritize verification of existing compensating controls. This includes reviewing the effectiveness of current security measures and ensuring that appropriate patches or mitigations are applied. Additionally, defenders should monitor for potential exploitation attempts and track exceptions to ensure that vulnerabilities are properly addressed.

Why it matters

Unauthenticated SQL injection vulnerability in Weaver E-cology versions prior to 10.76 allows attackers to extract database information. Defenders should prioritize verifying exposure and assessing compensating controls.

  • Verify exposure of Weaver E-cology versions prior to 10.76
  • Assess potential for database information extraction
  • Prioritize patching or mitigating vulnerable deployments
  • Monitor for potential exploitation attempts

Technical summary

Weaver E-cology versions prior to 10.76 contain an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via /api/ec/dev/table/counts to extract database information. This vulnerability allows for potential database information extraction and defenders should prioritize verifying exposure and assessing compensating controls. The vulnerability was first observed by the Shadowserver Foundation on 2026-07-19.

Defensive priority

Defenders should prioritize verifying exposure of Weaver E-cology versions prior to 10.76 and assessing the effectiveness of existing compensating controls.

Recommended defensive actions

  • Verify exposure of Weaver E-cology versions prior to 10.76
  • Assess the effectiveness of existing compensating controls
  • Apply vendor-provided patch (if available)
  • Monitor for potential exploitation attempts
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the unauthenticated SQL injection vulnerability in Weaver E-cology versions prior to 10.76. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-71434 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-71434

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-71434 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-71434

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/71xxx/CVE-2025-71434.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://y4tacker.github.io/2025/07/09/year/2025/07/%E5%A6%82%E4%BD%95%E4%BB%8E%E7%81%B0%E7%9B%92%E8%A7%92%E5%BA%A6%E5%BF%AB%E9%80%9F%E5%A4%8D%E7%8E%B0Weaver-SQL%E6%B3%A8%E5%85%A5/

    Supplemental source - technical-description, exploit

  • Source reference

    Unverified legacy reference

    URL: https://1diot9.github.io/2026/05/13/%E6%B3%9B%E5%BE%AEe9%E5%88%86%E6%9E%90%E6%80%9D%E8%B7%AF/

    Supplemental source - technical-description, exploit

  • Source reference

    Unverified legacy reference

    URL: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/weaver/weaver-ecology9-doc-list-sqli.yaml

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://blog.csdn.net/murphysec/article/details/149236904

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://www.weaver.com.cn/cs/security/edm20250704_opiurutjvmopimdwytdc.html

    Supplemental source - vendor-advisory, patch

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/weaver-e-cology-10.76-unauthenticated-sql-injection-via-doc-out-more-list

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.