{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/e-cology--10.76/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:weaver:e-cology:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2025-71434"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["E-cology (\u003c 10.76)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["Weaver"],"content_html":"\u003cp\u003eWeaver E-cology versions 8.0, 9.0, and 10.0 prior to 10.76 contain a critical unauthenticated SQL injection vulnerability (CVE-2025-71434). Attackers can inject malicious payloads into the doc_datefrom or doc_dateto fields within the /api/doc/out/more/list endpoint when the elementmore parameter is set to srcType=2. Extracted data can be retrieved by the attacker via the /api/ec/dev/table/counts endpoint. The Shadowserver Foundation reported observed exploitation in the wild starting on 2026-07-19.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to exfiltrate sensitive data from the underlying database.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Weaver E-cology to version 10.76 or later immediately.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for HTTP requests to /api/doc/out/more/list containing suspicious characters (e.g., single quotes, SQL keywords) within the doc_datefrom or doc_dateto parameters.\u003c/li\u003e\n\u003cli\u003eAudit access to the /api/ec/dev/table/counts endpoint for anomalous patterns suggesting unauthorized data retrieval.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T14:16:23Z","date_published":"2026-10-22T14:16:23Z","id":"https://feed.craftedsignal.io/briefs/2026-10-weaver-ecology-sqli/","summary":"Weaver E-cology versions 8.0, 9.0, and 10.0 prior to 10.76 are vulnerable to unauthenticated SQL injection, allowing attackers to exfiltrate database information via the /api/doc/out/more/list and /api/ec/dev/table/counts endpoints.","title":"Weaver E-cology: Unauthenticated SQL injection (CVE-2025-71434)","url":"https://feed.craftedsignal.io/briefs/2026-10-weaver-ecology-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - E-Cology (\u003c 10.76)","version":"https://jsonfeed.org/version/1.1"}