Medium severity5.4NVD Advisory· Published Feb 3, 2021· Updated Jun 17, 2026

CVE-2020-9390

Description

SquaredUp allowed Stored XSS before version 4.6.0. A user was able to create a dashboard that executed malicious content in iframe or by uploading an SVG that contained a script.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

SquaredUp/SquaredUp2 versions
cpe:2.3:a:squaredup:squaredup:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:squaredup:squaredup:*:*:*:*:*:*:*:*range: <4.6
- (no CPE)range: <4.6.0
SquaredUp/SquaredUpdescription

Patches

Vulnerability mechanics

References

support.squaredup.com/hc/en-us/articles/360017568258nvdVendor Advisory
support.squaredup.com/hc/en-us/articles/360019427258-CVE-2020-9390-Stored-cross-site-scriptingnvdBroken Link
scomsupport.squaredup.com/hc/en-us/articles/8862922003869-CVE-2020-9390-Stored-cross-site-scripting-Web-Content-and-Visio-tile-nvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000