https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-37441.htmlhttps://patchthecve.com/cve/CVE-2021-37441.htmlWed, 17 Jun 2026 04:00:31 +0000HIGH 8.8: NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.. substring.https://patchthecve.com/cve/CVE-2021-37440.htmlhttps://patchthecve.com/cve/CVE-2021-37440.htmlWed, 17 Jun 2026 04:00:31 +0000MEDIUM 6.5: NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.. substring.https://patchthecve.com/cve/CVE-2021-37439.htmlhttps://patchthecve.com/cve/CVE-2021-37439.htmlWed, 17 Jun 2026 04:00:31 +0000MEDIUM 6.5: NCH FlexiServer v6.00 suffers from a syslog?file=/.. path traversal vulnerability.https://patchthecve.com/cve/CVE-2021-37469.htmlhttps://patchthecve.com/cve/CVE-2021-37469.htmlWed, 17 Jun 2026 04:00:37 +0000MEDIUM 6.5: In NCH WebDictate v2.13 and earlier, authenticated users can abuse logprop?file=/.. path traversal to read files on the filesystem.https://patchthecve.com/cve/CVE-2021-37468.htmlhttps://patchthecve.com/cve/CVE-2021-37468.htmlWed, 17 Jun 2026 04:00:36 +0000LOW 3.3: NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files.https://patchthecve.com/cve/CVE-2021-37452.htmlhttps://patchthecve.com/cve/CVE-2021-37452.htmlWed, 17 Jun 2026 04:00:35 +0000MEDIUM 5.5: NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading the local .dat configuration files.https://patchthecve.com/cve/CVE-2018-11552.htmlhttps://patchthecve.com/cve/CVE-2018-11552.htmlWed, 17 Jun 2026 01:36:09 +0000MEDIUM 6.1: There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field. The vulnerability exists due to insufficient filtration of user-supplied data. A remote attacker can execute arbitrary HTML and script code in a browser in the context of the vulnerable applicatihttps://patchthecve.com/cve/CVE-2018-11551.htmlhttps://patchthecve.com/cve/CVE-2018-11551.htmlWed, 17 Jun 2026 01:36:09 +0000HIGH 7.8: AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability exists because a DLL file is loaded by 'pbxsetup.exe' improperly.