Vinchin vulnerabilities

Products

• vinchin backup and recovery 9
• Backup & Recovery 9.0 2
• Backup and Recovery 1

Latest Vinchin CVEs

Newest publication first

1. CVE-2026-60095 Vinchin Backup & Recovery 9.0.0.86562 Stack Buffer Overflow via ModuleHandShake

   Published 2026-07-09

   Medium·CVSS 6.9 EPSS 0.75%

   Vinchin Backup & Recovery through 9.0.0.86562 contains a stack buffer overflow vulnerability in the ModuleHandShake function of the agentlink_server service that allows unauthenticated remote attackers to overwrite the saved return address by supplying an oversized _listen_uuid f...

2. CVE-2026-60094 Vinchin Backup & Recovery 9.0.0.86562 Heap Buffer Overflow via agentlink_server

   Published 2026-07-09

   Medium·CVSS 6.9 EPSS 0.64%

   Vinchin Backup & Recovery through 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause process crash or memory corruption by sending a malformed TCP packet with an unchecked body_len field to the agentlink_server service....

3. CVE-2024-25228 Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.

   Published 2024-03-14

   High·CVSS 8.8 EPSS 25.9%

   Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.

4. CVE-2024-22900 Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function.

   Published 2024-02-02

   High·CVSS 8.8 EPSS 1.9%

   Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function.

5. CVE-2024-22899 Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function.

   Published 2024-02-02

   High·CVSS 8.8 EPSS 2.4%

   Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function.

6. CVE-2024-22903 Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function.

   Published 2024-02-02

   High·CVSS 8.8 EPSS 1.9%

   Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function.

7. CVE-2024-22901 Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.

   Published 2024-02-02

   Critical·CVSS 9.8 EPSS 1.1%

   Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.

8. CVE-2024-22902 Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.

   Published 2024-02-02

   Critical·CVSS 9.8 EPSS 1.1%

   Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.

9. CVE-2023-45499 VinChin Backup & Recovery v5.0., v6.0., v6.7., and v7.0. was discovered to contain hardcoded credentials.

   Published 2023-10-27

   Critical·CVSS 9.8 EPSS 8.5% Framework module

   VinChin Backup & Recovery v5.0., v6.0., v6.7., and v7.0. was discovered to contain hardcoded credentials.

10. CVE-2023-45498 VinChin Backup & Recovery v5.0., v6.0., v6.7., and v7.0. was discovered to contain a command injection vulnerability.

    Published 2023-10-27

    Critical·CVSS 9.8 EPSS 22.0% Framework module

    VinChin Backup & Recovery v5.0., v6.0., v6.7., and v7.0. was discovered to contain a command injection vulnerability.

11. CVE-2022-35866 This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery 6.5.0.17561. Authentication is not required to exploit this vulnerability.....

    Published 2022-08-03

    Critical·CVSS 9.8 EPSS 4.7%

    This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery 6.5.0.17561. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the MySQL server. The serve...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.