CVE-2026-96535 — Cross-Site Scripting in the YouMind web application
Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitis…
Published: 2026-10-13 · CVSS: 5.1 · CVSS 4.0
Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The file is served by the CDN with Content-Type: image/svg+xml and, when navigating directly to that URL, the script executes within the context of the CDN’s domain.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7