Vulnerabilities

TI-2026-42825 CVE-2026-60095 · GHSA-34r7-v6pv-xq6v

Vinchin Backup & Recovery 9.0.0.86562 Stack Buffer Overflow via ModuleHandShake

LOW 38

Vinchin Backup & Recovery through 9.0.0.86562 contains a stack buffer overflow vulnerability in the ModuleHandShake function of the agentlink_server service that allows unauthenticated remote attackers to overwrite the s…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00745 Published 2026-07-09 No fix listed CWE-121

TI-2026-42824 CVE-2026-60094 · GHSA-m3jh-5jc7-f446

Vinchin Backup & Recovery 9.0.0.86562 Heap Buffer Overflow via agentlink_server

LOW 37

Vinchin Backup & Recovery through 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause process crash or memory corruption by sending a malformed TCP packet with…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0064 Published 2026-07-09 No fix listed CWE-787

TI-2024-16656 CVE-2024-25228 · GHSA-2hx4-gpwf-5qv2

Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code…

HIGH 73

Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.25887 Published 2024-03-14 No fix listed CWE-77

TI-2024-15174 CVE-2024-22903 · GHSA-45qr-r98p-f6qx

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code…

HIGH 73

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01876 Published 2024-02-02 No fix listed CWE-77

TI-2024-15173 CVE-2024-22902 · GHSA-97vr-j4hr-qrq8

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.

HIGH 82

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01077 Published 2024-02-02 No fix listed

TI-2024-15172 CVE-2024-22901 · GHSA-fgv7-7rh4-3353

Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.

HIGH 82

Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0111 Published 2024-02-02 No fix listed

TI-2024-15171 CVE-2024-22900 · GHSA-5ppc-gr6c-jgcj

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code…

MEDIUM 50

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01899 Published 2024-02-02 No fix listed CWE-77

TI-2024-15170 CVE-2024-22899 · GHSA-2wmp-6cvh-326h

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code…

HIGH 73

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02389 Published 2024-02-02 No fix listed CWE-94

TI-2023-24361 CVE-2023-45499 · GHSA-gj84-56mj-c85j

VinChin Backup & Recovery v5.0., v6.0., v6.7., and v7.0. was discovered to contain hardcoded credentials.

MEDIUM 53

VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08496 Published 2023-10-27 No fix listed CWE-798

TI-2023-24360 CVE-2023-45498 · GHSA-565x-m8jw-g2f2

VinChin Backup & Recovery v5.0., v6.0., v6.7., and v7.0. was discovered to contain a…

HIGH 68

VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.2197 Published 2023-10-27 No fix listed CWE-77

TI-2022-16297 CVE-2022-35866 · GHSA-3v9w-qp9v-wq29

Hard-coded credentials in Vinchin Backup and Recovery

MEDIUM 56

This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery 6.5.0.17561.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04716 Published 2022-08-03 No fix listed CWE-798

Vulnerabilities

Filters