Skip to content
Threat Feed
Subscribe
high threat

Weaver E-cology: Unauthenticated SQL injection (CVE-2025-71434)

Weaver E-cology versions 8.0, 9.0, and 10.0 prior to 10.76 are vulnerable to unauthenticated SQL injection, allowing attackers to exfiltrate database information via the /api/doc/out/more/list and /api/ec/dev/table/counts endpoints.

CVE search metadata

CVE search record: CVE-2025-71434. Severity: high. CVSS: 8.2. KEV: no. Product: E-cology (< 10.76). Brief: Weaver E-cology: Unauthenticated SQL injection (CVE-2025-71434). Brief link: https://feed.craftedsignal.io/briefs/2026-10-weaver-ecology-sqli/

Triage facts

Revision 1
Applicability
E-cology (< 10.76)
Evidence
Unknown
Severity
High
Action
Immediate escalation
Sources
1 public source
Freshness
Revision 1Oct 22, 14:16 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Very likely

Weaver E-cology versions 8.0, 9.0, and 10.0 prior to 10.76 contain a critical unauthenticated SQL injection vulnerability (CVE-2025-71434). Attackers can inject malicious payloads into the doc_datefrom or doc_dateto fields within the /api/doc/out/more/list endpoint when the elementmore parameter is set to srcType=2. Extracted data can be retrieved by the attacker via the /api/ec/dev/table/counts endpoint. The Shadowserver Foundation reported observed exploitation in the wild starting on 2026-07-19.

Impact

Successful exploitation allows unauthenticated attackers to exfiltrate sensitive data from the underlying database.

Recommendation

  • Patch Weaver E-cology to version 10.76 or later immediately.
  • Monitor web server logs for HTTP requests to /api/doc/out/more/list containing suspicious characters (e.g., single quotes, SQL keywords) within the doc_datefrom or doc_dateto parameters.
  • Audit access to the /api/ec/dev/table/counts endpoint for anomalous patterns suggesting unauthorized data retrieval.

Immediate actions

Patch Weaver E-cology to version 10.76 or later

IT Operations 24h

Mitigations

Upgrade Weaver E-cology to 10.76 or later

immediate IT Operations

CVE-2025-71434

Detection coverage 1

Detect CVE-2025-71434 Exploitation - SQL Injection in Weaver E-cology

high

Detects exploitation attempts against CVE-2025-71434 by identifying malicious SQL patterns in the doc_datefrom or doc_dateto parameters of the /api/doc/out/more/list endpoint.

sigma tactics: exfiltration, initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →