CVE-2020-9390: Squaredup

Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days.

SquaredUp allowed Stored XSS before version 4.6.0. A user was able to create a dashboard that executed malicious content in iframe or by uploading an SVG that contained a script.

Affected products

• Squaredup Squaredup: before 4.6 (fixed in 4.6)

Published 2021-02-03. Last modified 2026-06-17.