https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-37449.htmlhttps://patchthecve.com/cve/CVE-2021-37449.htmlWed, 17 Jun 2026 04:00:34 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).https://patchthecve.com/cve/CVE-2021-37448.htmlhttps://patchthecve.com/cve/CVE-2021-37448.htmlWed, 17 Jun 2026 04:00:34 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).https://patchthecve.com/cve/CVE-2021-37447.htmlhttps://patchthecve.com/cve/CVE-2021-37447.htmlWed, 17 Jun 2026 04:00:34 +0000HIGH 8.1: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion.https://patchthecve.com/cve/CVE-2021-37446.htmlhttps://patchthecve.com/cve/CVE-2021-37446.htmlWed, 17 Jun 2026 04:00:34 +0000MEDIUM 4.3: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading.https://patchthecve.com/cve/CVE-2021-37445.htmlhttps://patchthecve.com/cve/CVE-2021-37445.htmlWed, 17 Jun 2026 04:00:34 +0000MEDIUM 6.5: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading.https://patchthecve.com/cve/CVE-2021-37444.htmlhttps://patchthecve.com/cve/CVE-2021-37444.htmlWed, 17 Jun 2026 04:00:34 +0000HIGH 8.8: NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file for the the inbuilt Auhttps://patchthecve.com/cve/CVE-2021-37443.htmlhttps://patchthecve.com/cve/CVE-2021-37443.htmlWed, 17 Jun 2026 04:00:33 +0000HIGH 8.1: NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.https://patchthecve.com/cve/CVE-2021-37442.htmlhttps://patchthecve.com/cve/CVE-2021-37442.htmlWed, 17 Jun 2026 04:00:33 +0000MEDIUM 6.5: NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files.https://patchthecve.com/cve/CVE-2021-37470.htmlhttps://patchthecve.com/cve/CVE-2021-37470.htmlWed, 17 Jun 2026 04:00:37 +0000MEDIUM 5.4: In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript.https://patchthecve.com/cve/CVE-2021-37467.htmlhttps://patchthecve.com/cve/CVE-2021-37467.htmlWed, 17 Jun 2026 04:00:36 +0000MEDIUM 5.4: In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).https://patchthecve.com/cve/CVE-2021-37466.htmlhttps://patchthecve.com/cve/CVE-2021-37466.htmlWed, 17 Jun 2026 04:00:36 +0000MEDIUM 5.4: In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).https://patchthecve.com/cve/CVE-2021-37465.htmlhttps://patchthecve.com/cve/CVE-2021-37465.htmlWed, 17 Jun 2026 04:00:36 +0000MEDIUM 5.4: In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).https://patchthecve.com/cve/CVE-2021-37464.htmlhttps://patchthecve.com/cve/CVE-2021-37464.htmlWed, 17 Jun 2026 04:00:36 +0000MEDIUM 5.4: In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).https://patchthecve.com/cve/CVE-2021-37463.htmlhttps://patchthecve.com/cve/CVE-2021-37463.htmlWed, 17 Jun 2026 04:00:36 +0000MEDIUM 5.4: In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).https://patchthecve.com/cve/CVE-2021-37462.htmlhttps://patchthecve.com/cve/CVE-2021-37462.htmlWed, 17 Jun 2026 04:00:36 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).https://patchthecve.com/cve/CVE-2021-37461.htmlhttps://patchthecve.com/cve/CVE-2021-37461.htmlWed, 17 Jun 2026 04:00:36 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).https://patchthecve.com/cve/CVE-2021-37460.htmlhttps://patchthecve.com/cve/CVE-2021-37460.htmlWed, 17 Jun 2026 04:00:36 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).https://patchthecve.com/cve/CVE-2021-37459.htmlhttps://patchthecve.com/cve/CVE-2021-37459.htmlWed, 17 Jun 2026 04:00:35 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).https://patchthecve.com/cve/CVE-2021-37458.htmlhttps://patchthecve.com/cve/CVE-2021-37458.htmlWed, 17 Jun 2026 04:00:35 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).https://patchthecve.com/cve/CVE-2021-37457.htmlhttps://patchthecve.com/cve/CVE-2021-37457.htmlWed, 17 Jun 2026 04:00:35 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).https://patchthecve.com/cve/CVE-2021-37456.htmlhttps://patchthecve.com/cve/CVE-2021-37456.htmlWed, 17 Jun 2026 04:00:35 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored).https://patchthecve.com/cve/CVE-2021-37455.htmlhttps://patchthecve.com/cve/CVE-2021-37455.htmlWed, 17 Jun 2026 04:00:35 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored).https://patchthecve.com/cve/CVE-2021-37454.htmlhttps://patchthecve.com/cve/CVE-2021-37454.htmlWed, 17 Jun 2026 04:00:35 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).https://patchthecve.com/cve/CVE-2021-37453.htmlhttps://patchthecve.com/cve/CVE-2021-37453.htmlWed, 17 Jun 2026 04:00:35 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).https://patchthecve.com/cve/CVE-2021-37451.htmlhttps://patchthecve.com/cve/CVE-2021-37451.htmlWed, 17 Jun 2026 04:00:34 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).https://patchthecve.com/cve/CVE-2021-37450.htmlhttps://patchthecve.com/cve/CVE-2021-37450.htmlWed, 17 Jun 2026 04:00:34 +0000MEDIUM 5.4: Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).https://patchthecve.com/cve/CVE-2020-13476.htmlhttps://patchthecve.com/cve/CVE-2020-13476.htmlWed, 17 Jun 2026 02:53:12 +0000MEDIUM 4.8: NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module.https://patchthecve.com/cve/CVE-2020-13474.htmlhttps://patchthecve.com/cve/CVE-2020-13474.htmlWed, 17 Jun 2026 02:53:11 +0000MEDIUM 6.5: In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as Add/Edit users.https://patchthecve.com/cve/CVE-2020-13473.htmlhttps://patchthecve.com/cve/CVE-2020-13473.htmlWed, 17 Jun 2026 02:53:11 +0000MEDIUM 5.5: NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration file.https://patchthecve.com/cve/CVE-2020-11560.htmlhttps://patchthecve.com/cve/CVE-2020-11560.htmlWed, 17 Jun 2026 02:50:24 +0000HIGH 7.8: NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.https://patchthecve.com/cve/CVE-2020-11561.htmlhttps://patchthecve.com/cve/CVE-2020-11561.htmlWed, 17 Jun 2026 02:50:24 +0000HIGH 8.8: In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as the "Add New Item" screen.https://patchthecve.com/cve/CVE-2019-16330.htmlhttps://patchthecve.com/cve/CVE-2019-16330.htmlWed, 17 Jun 2026 02:22:08 +0000MEDIUM 5.4: In NCH Express Accounts Accounting v7.02, persistent cross site scripting (XSS) exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript.https://patchthecve.com/cve/CVE-2019-16282.htmlhttps://patchthecve.com/cve/CVE-2019-16282.htmlWed, 17 Jun 2026 02:22:03 +0000MEDIUM 5.4: In NCH Express Invoice v7.12, persistent cross site scripting (XSS) exists via the Invoices/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Items/Customers fields parameter to inject arbitrary JavaScript.https://patchthecve.com/cve/CVE-2010-5220.htmlhttps://patchthecve.com/cve/CVE-2010-5220.htmlTue, 16 Jun 2026 23:26:21 +0000MEDIUM 6.9: Untrusted search path vulnerability in MEO Encryption Software 2.02 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .meo or .cry file. NOTE: some of these details are obtained from third party