Shenzhen Shine Industrial Co., Ltd. Vitafit
12 CVEs affecting Shenzhen Shine Industrial Co., Ltd. Vitafit. Latest disclosed: 2026-11-04. Critical: 2, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54384 | Critical | 9.8 | 2026-11-04 | VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's accou… |
CVE-2026-54378 | Critical | 9.6 | 2026-11-04 | VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by c… |
CVE-2026-54372 | High | 8.8 | 2026-11-04 | VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attacke… |
CVE-2026-54375 | High | 8.4 | 2026-11-04 | VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept… |
CVE-2026-54376 | High | 8.2 | 2026-11-04 | VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to interce… |
CVE-2026-54382 | High | 7.7 | 2026-11-04 | VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to pe… |
CVE-2026-54381 | High | 7.5 | 2026-11-04 | VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download sto… |
CVE-2026-54374 | High | 7.5 | 2026-11-04 | VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-… |
CVE-2026-54383 | Medium | 6.5 | 2026-11-04 | VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/sear… |
CVE-2026-54377 | Medium | 6.5 | 2026-11-04 | VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's da… |
CVE-2026-54380 | Medium | 5.4 | 2026-11-04 | VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing… |
CVE-2026-54373 | Low | 3.5 | 2026-11-04 | VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modi… |