CVE-2018-25382 HIGH

CVE-2018-25382: Zechat 1.5 SQL Injection via uname Parameter

Vendor Bylancer
Product Zechat
Weakness CWE-89 · SQLi
Published May 29, 2026
Last update June 2, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Zechat 1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the uname parameter. Attackers can send crafted requests to profile.php with UNION-based SQL injection payloads to retrieve table names, column names, and sensitive data from the information_schema database.

Key dates

02Disclosure timeline

May 29, 2026 CVE published
June 2, 2026 Record updated