CVE-2018-25338 HIGH

CVE-2018-25338: Zechat 1.5 SQL Injection via hashtag parameter

Vendor Bylancer

Product Zechat

Weakness CWE-89 · SQLi

Published May 17, 2026

Last update May 18, 2026

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Zechat 1.5 contains a SQL injection vulnerability in the hashtag parameter that allows unauthenticated attackers to extract database information using union-based techniques. Attackers can exploit the hashtag parameter with union-based payloads to retrieve table and column names.

Key dates

02Disclosure timeline

May 17, 2026 CVE published

May 18, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-25338 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2024-12612 School Management System for Wordpress <= 93.2.0 - Unauthenticated SQL Injection CVE-2024-5207 POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection CVE-2013-10013 Bricco Authenticator Plugin DBAuthenticator.java compare sql injection CVE-2024-4779 Unlimited Elements for Elementor <= 1.5.107 - Authenticated (Contributor+) SQL Injection via data[post_ids][0] CVE-2025-13277 code-projects Nero Social Networking Site friendsphoto.php sql injection