Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

VitaFit — Vulnerabilities & Security Advisories 12

All 12 CVE vulnerabilities found in VitaFit, with AI-generated Chinese analysis, references, and POCs.

Vendor: Shenzhen Shine Industrial Co., Ltd.

CVE ID Title CVSS Severity Published
CVE-2026-54384 VitaFit Cloud API Authentication Bypass via POST /front/login/sns/ CWE-290 9.8 Critical 2026-11-04
CVE-2026-54383 VitaFit Cloud API Excessive Data Exposure via relation/search Endpoint CWE-862 6.5 Medium 2026-11-04
CVE-2026-54382 VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access CWE-266 7.7 High 2026-11-04
CVE-2026-54381 VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure CWE-732 7.5 High 2026-11-04
CVE-2026-54380 VitaFit Cloud API Stored XSS via SVG File Upload CWE-79 5.4 Medium 2026-11-04
CVE-2026-54378 VitaFit Cloud API Broken Access Control via S3 Token Endpoint CWE-522 9.6 Critical 2026-11-04
CVE-2026-54377 VitaFit Cloud API IDOR via profile_id Endpoints CWE-639 6.5 Medium 2026-11-04
CVE-2026-54376 VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking CWE-926 8.2 High 2026-11-04
CVE-2026-54375 VitaFit Android < 2.8.1.0 Long-Lived Session Token Exposure CWE-613 8.4 High 2026-11-04
CVE-2026-54374 VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure CWE-798 7.5 High 2026-11-04
CVE-2026-54373 VitaFit Android < 2.8.1.0 Cleartext Traffic via Missing Network Security Config CWE-319 3.5 Low 2026-11-04
CVE-2026-54372 VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation CWE-295 8.8 High 2026-11-04

All 12 known CVE vulnerabilities affecting VitaFit with full Chinese analysis, references, and POCs where available.