Is CVE-2019-25776 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-25776 being exploited in the wild.

How severe is CVE-2019-25776?

High severity, with a CVSS score of 7.5, published 18 September 2026.

Is there a fix for CVE-2019-25776?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2019-25776 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2019-25776?

Check whether you run Weaver E-cology. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-25776: Weaver E-cology SQL injection in mobile plugin

CVE-2019-25776 · Severity: high · CVSS 7.5 · Published 2026-09-18

Weaver E-cology, a widely-deployed office automation system in China, contains an unauthenticated SQL injection vulnerability in its mobile plugin that allows attackers to extract sensitive data from the database. Attackers can bypass the application's SQL keyword filters by wrapping keywords in parentheses, enabling them to harvest administrator credential hashes and other confidential information without needing to authenticate first.

Technologies: Weaver E-cology. Vendors: Weaver.

Quick answers

Is CVE-2019-25776 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-25776 being exploited in the wild.
How severe is CVE-2019-25776?: High severity, with a CVSS score of 7.5, published 18 September 2026.
Which products and versions are affected?: Weaver E-cology.
Is there a fix for CVE-2019-25776?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2019-25776 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2019-25776?: Check whether you run Weaver E-cology. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the mobile plugin endpoint (SyncUserInfo.jsp) where the userIdentifiers GET parameter is not properly sanitized before being used in SQL queries. Attackers can perform UNION-based SQL injection by submitting specially-crafted input that bypasses space-based filter controls, allowing arbitrary query execution. The vulnerability requires only network access and no authentication; exploitation yields unauthorized access to sensitive database records including administrator credentials.

Affected products

Weaver E-cology

Timeline

2019: disclosed: CVE-2019-25776 assigned
2022-07-28: exploited: Exploitation observed by Shadowserver Foundation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.