Youmind Web Application
Monthly
Stored cross-site scripting in the YouMind web application lets an authenticated user abuse the avatar update endpoint by pointing it at an arbitrary URL that hosts an SVG image containing embedded JavaScript, which the platform's CDN then serves unsanitised as image/svg+xml; the payload only executes when a victim navigates directly to that CDN-hosted avatar URL, running in the CDN origin rather than the main YouMind application domain. Rated Medium at CVSS 5.1 (CVSS 4.0: AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N, no subsequent-system impact), the flaw requires a valid account with avatar-update privileges and active victim interaction, and the cross-domain execution context bounds what an attacker can reach; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the YouMind web application lets an authenticated user abuse the avatar update endpoint by pointing it at an arbitrary URL that hosts an SVG image containing embedded JavaScript, which the platform's CDN then serves unsanitised as image/svg+xml; the payload only executes when a victim navigates directly to that CDN-hosted avatar URL, running in the CDN origin rather than the main YouMind application domain. Rated Medium at CVSS 5.1 (CVSS 4.0: AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N, no subsequent-system impact), the flaw requires a valid account with avatar-update privileges and active victim interaction, and the cross-domain execution context bounds what an attacker can reach; no public exploit code has been identified at time of analysis.