Threats tagged 'ghsa-vg4v-xjcr-x7p5'

Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain a critical unauthenticated remote code execution vulnerability. The flaw exists in the /papi/esearch/data/devops/dubboApi/debug/method endpoint, which exposes debug functionality that attackers can abuse by sending crafted POST requests. This allows arbitrary command execution on the affected system without authentication. The vulnerability was publicly disclosed in April 2026, with exploitation evidence first observed on 2026-03-31. The CVSS score is 9.8, indicating a critical severity level.