Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H N N 8.7 .0036 27.6 —
AFFECTED Product Versions Fixed E-cology unspecified —
TIMELINE Sep 18 Reserved by VulnCheck Sep 18 Published (CNA: VulnCheck) Sep 22 EXPLOIT PUBLISHED — CVE-2019-25776 (Weaver Network Co., Ltd. E-cology). Public exploit reference added.
Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping SQL keywords in parentheses to perform UNION-based injection and extract sensitive data including administrator credential hashes from the database. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-07-28.
| Date | Event | Detail |
|---|---|---|
| September 18, 2026 | Reserved | Reserved by VulnCheck |
| September 18, 2026 | Published | Published (CNA: VulnCheck) |
| September 22, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2019-25776 (Weaver Network Co., Ltd. E-cology). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Weaver Network Co., Ltd. | E-cology | — | — | — |
Authoritative record: CVE-2019-25776 at cve.org
Vendors: weaver network co
Weaknesses: CWE-89
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2019-25776 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
