CVE-2020-9388: Squaredup

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

CSRF protection was not present in SquaredUp before version 4.6.0. A CSRF attack could have been possible by an administrator executing arbitrary code in a HTML dashboard tile via a crafted HTML page, or by uploading a malicious SVG payload into a dashboard.

Affected products

• Squaredup Squaredup: before 4.6 (fixed in 4.6); up to and including 4.6

Published 2021-02-03. Last modified 2026-06-17.