https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-37441.htmlhttps://patchthecve.com/cve/CVE-2021-37441.htmlWed, 17 Jun 2026 04:00:31 +0000HIGH 8.8: NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.. substring.https://patchthecve.com/cve/CVE-2021-37440.htmlhttps://patchthecve.com/cve/CVE-2021-37440.htmlWed, 17 Jun 2026 04:00:31 +0000MEDIUM 6.5: NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.. substring.https://patchthecve.com/cve/CVE-2021-37462.htmlhttps://patchthecve.com/cve/CVE-2021-37462.htmlWed, 17 Jun 2026 04:00:36 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).https://patchthecve.com/cve/CVE-2021-37461.htmlhttps://patchthecve.com/cve/CVE-2021-37461.htmlWed, 17 Jun 2026 04:00:36 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).https://patchthecve.com/cve/CVE-2021-37460.htmlhttps://patchthecve.com/cve/CVE-2021-37460.htmlWed, 17 Jun 2026 04:00:36 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).https://patchthecve.com/cve/CVE-2021-37459.htmlhttps://patchthecve.com/cve/CVE-2021-37459.htmlWed, 17 Jun 2026 04:00:35 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).https://patchthecve.com/cve/CVE-2021-37458.htmlhttps://patchthecve.com/cve/CVE-2021-37458.htmlWed, 17 Jun 2026 04:00:35 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).https://patchthecve.com/cve/CVE-2021-37457.htmlhttps://patchthecve.com/cve/CVE-2021-37457.htmlWed, 17 Jun 2026 04:00:35 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).https://patchthecve.com/cve/CVE-2021-37456.htmlhttps://patchthecve.com/cve/CVE-2021-37456.htmlWed, 17 Jun 2026 04:00:35 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored).https://patchthecve.com/cve/CVE-2021-37455.htmlhttps://patchthecve.com/cve/CVE-2021-37455.htmlWed, 17 Jun 2026 04:00:35 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored).https://patchthecve.com/cve/CVE-2021-37454.htmlhttps://patchthecve.com/cve/CVE-2021-37454.htmlWed, 17 Jun 2026 04:00:35 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).https://patchthecve.com/cve/CVE-2021-37453.htmlhttps://patchthecve.com/cve/CVE-2021-37453.htmlWed, 17 Jun 2026 04:00:35 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).https://patchthecve.com/cve/CVE-2018-11552.htmlhttps://patchthecve.com/cve/CVE-2018-11552.htmlWed, 17 Jun 2026 01:36:09 +0000MEDIUM 6.1: There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field. The vulnerability exists due to insufficient filtration of user-supplied data. A remote attacker can execute arbitrary HTML and script code in a browser in the context of the vulnerable applicatihttps://patchthecve.com/cve/CVE-2018-11551.htmlhttps://patchthecve.com/cve/CVE-2018-11551.htmlWed, 17 Jun 2026 01:36:09 +0000HIGH 7.8: AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability exists because a DLL file is loaded by 'pbxsetup.exe' improperly.