CVE-2026-54380Medium· 5.4▾ SunlitVitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the application's failure to restrict scripts or force downloads for image/svg+xml content, causing the JavaScript to execute when a victim opens the file via direct browser navigation.
VitaFit < 2026-10-30Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54384Critical· 9.8VitaFit Cloud API Authentication Bypass via POST /front/login/sns/
CVE-2026-54383Medium· 6.5VitaFit Cloud API Excessive Data Exposure via relation/search Endpoint
CVE-2026-54381High· 7.5VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure
CVE-2026-54382High· 7.7VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access
CVE-2026-54378Critical· 9.6VitaFit Cloud API Broken Access Control via S3 Token Endpoint
CVE-2026-54377Medium· 6.5VitaFit Cloud API IDOR via profile_id Endpoints