CVE-2018-25338: Bylancer Zechat

High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days.

Zechat 1.5 contains a SQL injection vulnerability in the hashtag parameter that allows unauthenticated attackers to extract database information using union-based techniques. Attackers can exploit the hashtag parameter with union-based payloads to retrieve table and column names.

Affected products

• Bylancer Zechat: version 1.5 only

Published 2026-05-17. Last modified 2026-06-17.