Vinchin Backup & Recovery version 7.2 contains an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function. This vulnerability allows an attacker with valid credentials to execute arbitrary code remotely. The flaw is classified under CWE-94 (Improper Control of Generation of Code).