Loading story…
Two critical server-side vulnerabilities have exposed widely deployed web applications to full remote compromise without authentication. In AVideo, CVE-2025-34433 was rated CVSS 10.0 after researchers reported a deterministic cryptographic failure that enables immediate remote code execution during normal HTTP request processing. Successful exploitation can grant attackers the privileges of the web server process, with broad read and write access to the application directory, internal database, and uploaded media, creating a complete confidentiality, integrity, and availability failure. The flaw is considered highly reliable because it does not depend on memory corruption and is not meaningfully hindered by mitigations such as ASLR, DEP, or stack canaries; reports also noted the existence of weaponized exploit modules.
A separate actively exploited flaw, CVE-2026-22679, affects Weaver (Fanwei) E-cology 10.0 builds before 20260312. The vulnerability stems from an exposed debug endpoint that forwards attacker-controlled JSON into the Dubbo RPC framework without authentication or validation, allowing arbitrary operating system command execution through the Java application running under Tomcat. Threat intelligence tied exploitation to internet-facing systems shortly after the vendor patch, with observed activity including ping-based verification, PowerShell payload retrieval, attempted MSI deployment, and evasive techniques such as renamed PowerShell binaries and in-memory execution. Defenders were urged to upgrade affected systems, watch for suspicious child processes spawned by java.exe, and review EDR telemetry for obfuscated or fileless post-exploitation behavior.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Cyberpress reported that CVE-2026-22679 was being actively exploited against vulnerable Weaver E-cology 10.0 instances and urged organizations to upgrade, hunt for suspicious java.exe child processes, and block known malicious infrastructure.
A report disclosed CVE-2025-34433 in AVideo as a critical unauthenticated remote code execution flaw caused by cryptographic failures, with a CVSS v4.0 score of 10.0. The issue enables reliable code execution with web server privileges and broad access to the application directory, database, and uploaded media.
Threat intelligence indicates exploitation of the Weaver E-cology flaw was underway by 2026-03-17. Observed activity included ping-based verification, PowerShell payload retrieval, attempted MSI deployment, and evasive execution techniques on an internet-facing Windows server.
Weaver (Fanwei) patched CVE-2026-22679 in E-cology 10.0 builds on 2026-03-12 by removing the exposed debug endpoint that allowed unauthenticated command execution through Dubbo RPC.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Weaver (Fanwei) **E-cology** deployments are affected by two high-severity vulnerabilities that allow unauthenticated attackers to compromise exposed servers. **`CVE-2026-22679`** impacts E-cology **10.0** versions prior to **20260312** and enables remote code execution through the `/papi/esearch/data/devops/dubboApi/debug/method` endpoint, where attacker-controlled `interfaceName` and `methodName` POST parameters can abuse exposed debug functionality to run arbitrary commands. The issue is classified as **CWE-306** and carries high impact across confidentiality, integrity, and availability, with exploitation observed in the wild by the Shadowserver Foundation. A second flaw, **`CVE-2022-50992`**, affects E-cology **9.5** versions prior to **10.52** and allows unauthenticated arbitrary file reads through the **`XmlRpcServlet`** XML-RPC interface. Attackers can supply file paths to the `WorkflowService.getAttachment` and `WorkflowService.LoadTemplateProp` methods to retrieve sensitive files from the server, including configuration data and database credentials. The vulnerability is mapped to **CWE-22**, and Shadowserver reported exploitation evidence dating back to 2022, underscoring continued exposure risk for internet-facing E-cology systems that remain unpatched.
Jun 29, 2026
WWBN **AVideo** was found to contain multiple high-severity vulnerabilities that can let attackers seize control of deployments, hijack user sessions, and access internal network resources. On uninitialized instances running version **25.0 or earlier**, `install/checkConfiguration.php` could be abused without authentication to complete setup, create an administrator account, and write configuration files, enabling full application takeover under **CVE-2026-33038**. Separate insecure defaults in the official Docker deployment path, tracked as **CVE-2026-33037**, left new installations exposed to immediate administrative compromise because the admin password defaulted to **"password"** and database credentials defaulted to `avideo/avideo`, with no forced password change or effective hardening. AVideo also exposed users and infrastructure through web-facing flaws in session handling and URL fetching. Under **CVE-2026-33043**, `/objects/phpsessionid.json.php` disclosed active PHP session IDs to unauthenticated requests, and permissive CORS behavior could allow cross-origin session theft and account takeover. Two SSRF issues affected the unauthenticated `plugin/LiveLinks/proxy.php` endpoint: **CVE-2026-33039** allowed redirect-based bypass of URL safety checks in version **25.0 and earlier**, while **CVE-2026-33480** showed that `isSSRFSafeURL()` could also be bypassed with IPv4-mapped IPv6 addresses, extending exposure through version **26.0** and enabling access to localhost, RFC1918 networks, and cloud metadata services. WWBN issued fixes in **AVideo 26.0** for most of the disclosed flaws, with an additional patch published for the IPv6-based SSRF bypass.
Jun 29, 2026
WWBN **AVideo** versions up to and including `26.0` are affected by two high-severity flaws that can lead to **remote code execution**. `CVE-2026-33482` is an OS command injection bug in `sanitizeFFmpegCommand()`, which strips some shell metacharacters but fails to remove bash command substitution using `$()`. Because the resulting `ffmpeg` command is later executed in a double-quoted `sh -c` context by `execAsync()`, an attacker able to craft a valid encrypted payload can run arbitrary commands on the standalone encoder server. A separate issue, `CVE-2026-33507`, allows unauthenticated code execution through the plugin import workflow. The `objects/pluginImport.json.php` endpoint permits admin users to upload and install plugin ZIP archives containing executable PHP, but lacks **CSRF** protection; with `session.cookie_samesite = 'None'` on HTTPS connections, an attacker can trick a logged-in administrator into silently importing a malicious plugin and deploying a PHP webshell. Fixes were introduced in commits `25c8ab90269e3a01fb4cf205b40a373487f022e1` and `d1bc1695edd9ad4468a48cea0df6cd943a2635f3`.
Jun 29, 2026