MetInfo CMS suffers from an unauthenticated PHP code injection vulnerability (CVE-2026-29014, CVSS 9.8) that insufficiently sanitizes user input, enabling remote code execution. Weaver E-cology has an unauthenticated remote code execution vulnerability (CVE-2026-22679, CVSS 9.3) due to exposed debug functionality accessible via crafted POST requests, allowing arbitrary command execution. Both vulnerabilities have been exploited in the wild shortly after disclosure, with Weaver E-cology patches released on March 12, 2026. Exploitation activity includes automated probing, payload delivery, and command execution via debug endpoints acting as shells. The attacks have focused on deployments primarily in China and Singapore.

Successful exploitation of these vulnerabilities allows unauthenticated remote attackers to execute arbitrary code on affected servers, leading to full server compromise. This can result in unauthorized control over the systems running MetInfo CMS or Weaver E-cology, potentially enabling data theft, service disruption, or further network penetration. Active exploitation has been observed, increasing the risk to organizations using these products, especially those with internet-facing deployments.

For Weaver E-cology, patches addressing the unauthenticated remote code execution vulnerability were released on March 12, 2026, and should be applied immediately. For MetInfo CMS, the patch status is not explicitly stated in the provided data; therefore, check the vendor advisory for current remediation guidance. Organizations should promptly apply available official fixes to mitigate these critical vulnerabilities. If patches are not yet available for MetInfo, monitor vendor advisories closely and consider temporary mitigations such as restricting access to vulnerable endpoints until a fix is applied.