---
id: "CVE-2025-71434"
kind: "vulnerability"
aliases: ["CVE-2025-71434"]
title: "Weaver E-cology: unauthenticated SQL injection leaks database contents"
severity: "high"
cvss: 8.8
epss: 0.00254
exploited: false
status: "open"
category: "other"
products: [{"name": "Weaver E-cology", "fixed": ["10.76"], "affected": "< 10.76", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["e-cology", "other", "self-hosted", "weaver"]
not_affected_if: ["default-config"]
published_at: "2026-10-22T11:17:06+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71434", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:41:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-71434", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Weaver E-cology: unauthenticated SQL injection leaks database contents

Weaver E-cology versions before 10.76 let an unauthenticated remote user inject SQL through the /api/doc/out/more/list endpoint. An attacker can then read database information through /api/ec/dev/table/counts.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Weaver E-cology affected < 10.76 fixed 10.76

## How to check

unknown: no vendor check published. Inspect your E-cology version (fixed in 10.76) and whether /api/doc/out/more/list is reachable from the internet; restrict it at the reverse proxy/WAF until upgraded.

## Fix

Upgrade Weaver E-cology to version 10.76 or later.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-71434
- 2026-10-23T23:41:52+00:00 analyst — Only NVD cited; NVD page unreadable via fetch, no vendor advisory, PoC or X discussion found (x-cli count 0; searches returned only unrelated Weaver CVEs). Fix 10.76 and endpoint come from triage summary, unverified by me. Check/workaround unknown; settle by reading Weaver security bulletin (weaver.com.cn) or NVD references.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2025-71434

## From the sources

Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via /api/ec/dev/table/counts to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_