CVE-2024-25228

Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

25.89% chance of exploitation in the next 30 days, 98th percentile

Published

2024-03-14

Updated

2025-11-04

Proof-of-concept exploits (1)

• https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/

References

• CVE Record
• NVD entry

Related

• CVE-2024-25227
• CVE-2024-2523
• CVE-2024-25225
• CVE-2024-25239
• CVE-2024-25224
• CVE-2024-2524