EUVD-2026-117157

VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the application's failure to restrict scripts or force downloads...

CVE-2026-54380

The VitaFit cloud API (versions prior to 2026-10-30) is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the application's failure to restrict scripts or enforce downloads for image/svg+xml content. This allows authenticated attackers to upload an SVG image conta...

PT-2026-137214

Name of the Vulnerable Software and Affected Versions VitaFit cloud API versions prior to 2026-10-30 Description An authenticated attacker can upload an SVG image containing malicious JavaScript to the shared storage bucket. The issue occurs because the application fails to restrict scripts or...