Vendors / Vinchin Records 11 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 5
CVSS high 4
Exploited now Vinchin records in CISA KEV No Vinchin vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01077 · Published 2024-02-02 · No fix listed
Priority HIGH 82
Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0111 · Published 2024-02-02 · No fix listed
Priority HIGH 73
Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.25887 · Published 2024-03-14 · No fix listed CWE-77
Priority HIGH 73
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01876 · Published 2024-02-02 · No fix listed CWE-77
Priority HIGH 73
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02389 · Published 2024-02-02 · No fix listed CWE-94
Priority HIGH 68
VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.2197 · Published 2023-10-27 · No fix listed CWE-77
Priority MEDIUM 56
This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery 6.5.0.17561.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04716 · Published 2022-08-03 · No fix listed CWE-798
Priority MEDIUM 53
VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08496 · Published 2023-10-27 · No fix listed CWE-798
Priority MEDIUM 50
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01899 · Published 2024-02-02 · No fix listed CWE-77
Open these records in search → All records by CVSS severity
5 4 2 0 0
THREATIST.IORead the docs