CVE-2026-96535
MEDIUM—CVSS v3
—CVSS v2
0.23%
EPSS (exploit probability)
CWE-79CWE
Description
Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The file is served by the CDN with Content-Type: image/svg+xml and, when navigating directly to that URL, the script executes within the context of the CDN’s domain.
Affected routers (0)
No routers currently mapped to this CVE in our database.