CVE-2024-25228

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
vinchin	vinchin_backup_and_recovery	7.2

References

https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/Exploit, Third Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/15Mailing List
http://seclists.org/fulldisclosure/2024/Mar/15
https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/Exploit, Third Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/15Mailing List

Timeline

Published: Mar 14, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-25236.1A vulnerability classified as problematic was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. This vulnerability affec CVE-2024-252399.8SQL Injection vulnerability in Sourcecodester Employee Management System v1.0 allows attackers to run arbitrary SQL commands via crafted POS CVE-2024-25248.8A vulnerability, which was classified as critical, has been found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. This issue CVE-2024-252479.8SQL Injection vulnerability in /app/api/controller/Store.php in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via latitude CVE-2024-252489.8SQL Injection vulnerability in the orderGoodsDelivery() function in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via the CVE-2024-252499.8An issue in He3 App for macOS version 2.0.17, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectAr CVE-2024-25256.1A vulnerability, which was classified as problematic, was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. Affected is CVE-2024-252509.8SQL Injection vulnerability in code-projects Agro-School Management System 1.0 allows attackers to run arbitrary code via the Login page.CVE-2024-252518.8code-projects Agro-School Management System 1.0 is suffers from Incorrect Access Control.CVE-2024-252537.5Driver Booster v10.6 was discovered to contain a buffer overflow via the Host parameter under the Customize proxy module.CVE-2024-252549.8SuperScan v4.1 was discovered to contain a buffer overflow via the Hostname/IP parameter.CVE-2024-252559.8Sublime Text 4 was discovered to contain a command injection vulnerability via the New Build System module. NOTE: multiple third parties rep