PatchTheCVE: quorumhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2021-37447: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.https://patchthecve.com/cve/CVE-2021-37447.htmlhttps://patchthecve.com/cve/CVE-2021-37447.htmlWed, 17 Jun 2026 04:00:34 +0000HIGH 8.1: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion.CVE-2021-37446: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.https://patchthecve.com/cve/CVE-2021-37446.htmlhttps://patchthecve.com/cve/CVE-2021-37446.htmlWed, 17 Jun 2026 04:00:34 +0000MEDIUM 4.3: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading.CVE-2021-37445: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.https://patchthecve.com/cve/CVE-2021-37445.htmlhttps://patchthecve.com/cve/CVE-2021-37445.htmlWed, 17 Jun 2026 04:00:34 +0000MEDIUM 6.5: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading.CVE-2021-37467: In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).https://patchthecve.com/cve/CVE-2021-37467.htmlhttps://patchthecve.com/cve/CVE-2021-37467.htmlWed, 17 Jun 2026 04:00:36 +0000MEDIUM 5.4: In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).CVE-2021-37466: In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).https://patchthecve.com/cve/CVE-2021-37466.htmlhttps://patchthecve.com/cve/CVE-2021-37466.htmlWed, 17 Jun 2026 04:00:36 +0000MEDIUM 5.4: In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).CVE-2021-37465: In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).https://patchthecve.com/cve/CVE-2021-37465.htmlhttps://patchthecve.com/cve/CVE-2021-37465.htmlWed, 17 Jun 2026 04:00:36 +0000MEDIUM 5.4: In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).CVE-2021-37464: In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).https://patchthecve.com/cve/CVE-2021-37464.htmlhttps://patchthecve.com/cve/CVE-2021-37464.htmlWed, 17 Jun 2026 04:00:36 +0000MEDIUM 5.4: In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).CVE-2021-37463: In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).https://patchthecve.com/cve/CVE-2021-37463.htmlhttps://patchthecve.com/cve/CVE-2021-37463.htmlWed, 17 Jun 2026 04:00:36 +0000MEDIUM 5.4: In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).CVE-2021-37452: NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by rhttps://patchthecve.com/cve/CVE-2021-37452.htmlhttps://patchthecve.com/cve/CVE-2021-37452.htmlWed, 17 Jun 2026 04:00:35 +0000MEDIUM 5.5: NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading the local .dat configuration files.