Advisories · Technology

Shenzhen Shine Industrial Co., Ltd. VitaFit.

Every CVE that names Shenzhen Shine Industrial Co., Ltd. VitaFit among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-54384 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

VitaFit Cloud API Authentication Bypass via POST /front/login/sns/
- Shenzhen Shine Industrial Co., Ltd. VitaFit
- Authentication bypass
Not analysed yet 4 Nov 2026
CVE-2026-54383 CVE record

CVSS 7.1 High

VitaFit Cloud API Excessive Data Exposure via relation/search Endpoint
- Shenzhen Shine Industrial Co., Ltd. VitaFit
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-54382 CVE record

CVSS 6.3 Medium

VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access
- Shenzhen Shine Industrial Co., Ltd. VitaFit
- Privilege escalation
Not analysed yet 4 Nov 2026
CVE-2026-54381 CVE record

CVSS 8.7 High

VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure
- Shenzhen Shine Industrial Co., Ltd. VitaFit
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-54380 CVE record

CVSS 5.1 Medium

VitaFit Cloud API Stored XSS via SVG File Upload
- Shenzhen Shine Industrial Co., Ltd. VitaFit
- Cross-site scripting (XSS)
Not analysed yet 4 Nov 2026
CVE-2026-54378 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

VitaFit Cloud API Broken Access Control via S3 Token Endpoint
- Shenzhen Shine Industrial Co., Ltd. VitaFit
- Hard-coded credentials
Not analysed yet 4 Nov 2026
CVE-2026-54377 CVE record

CVSS 6.9 Medium

VitaFit Cloud API IDOR via profile_id Endpoints
- Shenzhen Shine Industrial Co., Ltd. VitaFit
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-54376 CVE record

CVSS 8.2 High

VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking
- Shenzhen Shine Industrial Co., Ltd. VitaFit
- CWE-926
Not analysed yet 4 Nov 2026
CVE-2026-54375 CVE record

CVSS 8.6 High

VitaFit Android < 2.8.1.0 Long-Lived Session Token Exposure
- Shenzhen Shine Industrial Co., Ltd. VitaFit
- Authentication bypass
Not analysed yet 4 Nov 2026
CVE-2026-54374 CVE record

CVSS 8.7 High

VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure
- Shenzhen Shine Industrial Co., Ltd. VitaFit
- Hard-coded credentials
Not analysed yet 4 Nov 2026
CVE-2026-54373 CVE record

CVSS 5.1 Medium

VitaFit Android < 2.8.1.0 Cleartext Traffic via Missing Network Security Config
- Shenzhen Shine Industrial Co., Ltd. VitaFit
- Weak cryptography or TLS
Not analysed yet 4 Nov 2026
CVE-2026-54372 CVE record

CVSS 8.7 High

VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation
- Shenzhen Shine Industrial Co., Ltd. VitaFit
- Weak cryptography or TLS
Not analysed yet 4 Nov 2026