CVE-2023-2806

MEDIUM EXPLOITED

Weaver e-cology <9.0 - XML External Entity Reference

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-2806 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

A vulnerability classified as problematic was found in Weaver e-cology up to 9.0. Affected by this vulnerability is the function RequestInfoByXml of the component API. The manipulation leads to xml external entity reference. The associated identifier of this vulnerability is VDB-229411. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

References (3)

Core 3
Core References
Permissions Required, Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.229411
Permissions Required, Third Party Advisory, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.229411

Scores

CVSS v3 5.5
EPSS 0.0099
EPSS Percentile 57.9%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

VulnCheck KEV 2026-01-27
CWE
CWE-611
Status published
Products (1)
weaver/e-cology 9.0
Published May 19, 2023
Tracked Since Feb 18, 2026