CVE-2020-17372

SugarCRM before 10.1.0 (Q3 2020) allows XSS.