CVE-2021-40096

5.4 mediumEPSS 0.8%

Medium (5.4) in squaredup squaredup. EPSS 0.8% chance of exploitation in the next 30 days.

A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via modification of the authorisationUrl in some integration configurations.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-12-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

squaredup:squaredup

References

https://support.squaredup.com
https://support.squaredup.com/hc/en-us/articles/4410656396817-CVE-2021-40096-Stored-cross-site-scripting-provider-configuration-
https://support.squaredup.com
https://support.squaredup.com/hc/en-us/articles/4410656396817-CVE-2021-40096-Stored-cross-site-scripting-provider-configuration-

Check your stack JSON