Vendors / Vinchin Records 11 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 5
CVSS high 4
Exploited now Vinchin records in CISA KEV No Vinchin vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01077 · Published 2024-02-02 · No fix listed
Priority HIGH 82
Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0111 · Published 2024-02-02 · No fix listed
Priority HIGH 73
Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.25887 · Published 2024-03-14 · No fix listed CWE-77
Priority HIGH 73
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01876 · Published 2024-02-02 · No fix listed CWE-77
Priority HIGH 73
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02389 · Published 2024-02-02 · No fix listed CWE-94
Priority HIGH 68
VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.2197 · Published 2023-10-27 · No fix listed CWE-77
Priority MEDIUM 56
This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery 6.5.0.17561.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04716 · Published 2022-08-03 · No fix listed CWE-798
Priority MEDIUM 53
VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08496 · Published 2023-10-27 · No fix listed CWE-798
Priority MEDIUM 50
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01899 · Published 2024-02-02 · No fix listed CWE-77
Priority LOW 38
Vinchin Backup & Recovery through 9.0.0.86562 contains a stack buffer overflow vulnerability in the ModuleHandShake function of the agentlink_server service that allows unauthenticated remote attackers to overwrite the s…
CVSS 4.0 MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00745 · Published 2026-07-09 · No fix listed CWE-121
Priority LOW 37
Vinchin Backup & Recovery through 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause process crash or memory corruption by sending a malformed TCP packet with…
CVSS 4.0 MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.0064 · Published 2026-07-09 · No fix listed CWE-787
Open these records in search → All records by CVSS severity
5 4 2 0 0
THREATIST.IORead the docs