CVE-2025-71434 Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2025-71434?
CVE-2025-71434 is a high-severity vulnerability in Weaver Network Co., Ltd. E-cology, published on 22 Oct 2026.
Official description
Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via /api/ec/dev/table/counts to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19.
Weakness: CWE-89
Which versions are affected by CVE-2025-71434?
How do I fix CVE-2025-71434?
No fix has been published for CVE-2025-71434 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-71434 being exploited?
There is no known exploitation of CVE-2025-71434 in the wild and no public exploit code.
Sources
Also known as GHSA-gqhm-9jqr-x4r6.