What is CVE-2019-25776?

CVE-2019-25776 is a high-severity vulnerability in Weaver Network Co., Ltd. E-Cology, classified under SQL Injection. CVSS score: 7.5/10. Published 2026-09-18.

How severe is CVE-2019-25776?

High severity. CVSS v3 base score is 7.5 out of 10.

SQL Injection in Weaver Network Co., Ltd. E-Cology

CVE-2019-25776

Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping SQL keywords in parentheses to perform UNION-based injection and extract sensitive data including administrator credential hashes from the database. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-07-28.

Vulnerability class: SQL Injection

Published 2026-09-18 · last modified 2026-09-22.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.006 (48.7th percentile), scored 2026-11-02.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 48.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.006 · change: +0.002

Affected products

Weaver Network Co., Ltd. E-Cology

Weakness classification (CWE)

CWE-89 — SQL Injection

References

GitHub Exploit (exploit)
CN-SEC Blog (technical-description, exploit)
Vendor Changelog (product)
www.vulncheck.com/advisories/weaver-e-cology-sql-injection-via-syncuserinfo-jsp (third-party-advisory)

Frequently asked questions

What is CVE-2019-25776?: CVE-2019-25776 is a high-severity vulnerability in Weaver Network Co., Ltd. E-Cology, classified under SQL Injection. CVSS score: 7.5/10. Published 2026-09-18.
How severe is CVE-2019-25776?: High severity. CVSS v3 base score is 7.5 out of 10.