The vulnerability is a classic SQL injection carried out via the /api/doc/out/more/list API endpoint in Weaver E-cology. Because the server does not require authentication, an attacker can supply crafted input in the doc_datefrom and doc_dateto fields when the srcType parameter equals 2. The payload is then executed against the database, allowing the attacker to read results through the /api/ec/dev/table/counts endpoint. This flaw corresponds to CWE‑89 and can compromise the confidentiality of the information stored in the system.

Weaver Network Co., Ltd.’s E-cology platform is affected. All releases prior to version 10.76 – specifically versions 8.0, 9.0, and 10.0 – are vulnerable. Users relying on any of these releases should assume the weakness exists until an upgrade is performed.

The CVSS base score of 8.8 indicates high severity, and the lack of authentication requirement elevates the ease of exploitation. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the impact remains significant because the flaw permits direct database queries. Proven exploitation was observed on 2026-07-19 by the Shadowserver Foundation, demonstrating that active attackers can already enumerate data through the unrestricted endpoint. Consequently, the risk is high and should be treated as an urgent priority.