The vulnerability is a Cross‑Site Request Forgery that allows an attacker to modify a logged‑in user's information by bypassing the application’s anti‑CSRF protection. An encoded payload can be injected through the hashtag parameter, causing the server to accept the forged request as legitimate.

The affected application is Zechat 1.5 from Bylancer. Only this version is listed as vulnerable; no other versions were identified in the CNA data.

The CVSS score of 5.3 indicates a moderate risk and the EPSS score is not available, while the vulnerability is not listed in the CISA KEV catalog, suggesting low current exploitation activity. Exploitation requires a victim user to be authenticated and to visit a crafted link or form, after which the attacker can inject the malicious payload in the hashtag parameter and alter the user’s data without changing privileges beyond the legitimate session scope.