CVE-2020-9390

MEDIUM 5.4CVE-2020-9390 · Published 03/02/2021 · updated 17/06/2026

In short

CVE-2020-9390 is a MEDIUM (CVSS 5.4) vulnerability affecting squaredup (squaredup).
Chance of exploitation in the next 30 days (EPSS): 0.88%, higher than 59.3% of all vulnerabilities.
Fix: update to 4.6 or later.

Package	Affected versions	Patched versions
squaredup squaredup	`< 4.6`	`4.6`

Description

SquaredUp allowed Stored XSS before version 4.6.0. A user was able to create a dashboard that executed malicious content in iframe or by uploading an SVG that contained a script.

References

scomsupport.squaredup.com/hc/en-us/articles/8862922003869-CVE-2020-9390-Stored-cross-site-scripting-Web-Content-and-Visio-tile-
support.squaredup.com/hc/en-us/articles/360017568258 · Vendor Advisory
support.squaredup.com/hc/en-us/articles/360019427258-CVE-2020-9390-Stored-cross-site-scripting · Broken Link

More vulnerabilities in squaredup

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

squaredup

< 4.6

4.6

More vulnerabilities in squaredup

See all →