Vendor CVEs

NCH Software

All CVEs

40 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2021-37444	NCH Software Ivm Attendant	Hig	0.57	8.8	0.02	Jul 25, 2021	NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file…
CVE-2020-11561	NCH Software Express Invoice	Hig	0.57	8.8	0.02	Apr 7, 2020	In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as the "Add New Item" screen.
CVE-2020-11560	NCH Software Express Invoice	Hig	0.54	7.8	0.01	Apr 7, 2020	NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.
CVE-2021-37447	Nch Quorum	Hig	0.53	8.1	0.02	Jul 25, 2021	In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion.
CVE-2021-37443	Nch IVM Attendant	Hig	0.53	8.1	0.01	Jul 25, 2021	NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.
CVE-2021-37445	Nch Quorum	Med	0.42	6.5	0.01	Jul 25, 2021	In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading.
CVE-2021-37442	Nch IVM Attendant	Med	0.42	6.5	0.01	Jul 25, 2021	NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files.
CVE-2021-37440	Nch Axon Pbx	Med	0.42	6.5	0.01	Jul 25, 2021	NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.. substring.
CVE-2021-37439	Nch Flexiserver	Med	0.42	6.5	0.01	Jul 25, 2021	NCH FlexiServer v6.00 suffers from a syslog?file=/.. path traversal vulnerability.
CVE-2020-13474	NCH Software Express Accounts	Med	0.42	6.5	0.01	Dec 28, 2020	In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as Add/Edit users.
CVE-2020-13473	NCH Software Express Accounts	Med	0.36	5.5	0.00	Dec 28, 2020	NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration file.
CVE-2021-37449	Nch IVM Attendant	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).
CVE-2021-37448	Nch IVM Attendant	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).
CVE-2021-37470	Nch WebDictate	Med	0.35	5.4	0.01	Jul 25, 2021	In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript.
CVE-2021-37467	Nch Quorum	Med	0.35	5.4	0.01	Jul 25, 2021	In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).
CVE-2021-37466	Nch Quorum	Med	0.35	5.4	0.01	Jul 25, 2021	In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).
CVE-2021-37465	Nch Quorum	Med	0.35	5.4	0.01	Jul 25, 2021	In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).
CVE-2021-37464	Nch Quorum	Med	0.35	5.4	0.01	Jul 25, 2021	In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).
CVE-2021-37463	Nch Quorum	Med	0.35	5.4	0.01	Jul 25, 2021	In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).
CVE-2021-37462	Nch Axon Pbx	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).
CVE-2021-37461	Nch Axon Pbx	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).
CVE-2021-37460	Nch Axon Pbx	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).
CVE-2021-37459	Nch Axon Pbx	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).
CVE-2021-37458	Nch Axon Pbx	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).
CVE-2021-37457	Nch Axon Pbx	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).
CVE-2021-37456	Nch Axon Pbx	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored).
CVE-2021-37455	Nch Axon Pbx	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored).
CVE-2021-37454	Nch Axon Pbx	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).
CVE-2021-37453	Nch Axon Pbx	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).
CVE-2021-37451	Nch IVM Attendant	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).
CVE-2021-37450	Nch IVM Attendant	Med	0.35	5.4	0.01	Jul 25, 2021	Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).
CVE-2019-16330	NCH Software Express Accounts Accounting	Med	0.35	5.4	0.01	Oct 17, 2019	In NCH Express Accounts Accounting v7.02, persistent cross site scripting (XSS) exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject…
CVE-2019-16282	NCH Software Express Invoice	Med	0.35	5.4	0.01	Oct 14, 2019	In NCH Express Invoice v7.12, persistent cross site scripting (XSS) exists via the Invoices/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Items/Customers fields parameter to inject arbitrary JavaScript.
CVE-2020-13476	NCH Software Express Invoice	Med	0.31	4.8	0.01	Dec 28, 2020	NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module.
CVE-2021-37446	Nch Quorum	Med	0.28	4.3	0.01	Jul 25, 2021	In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading.
CVE-2008-2894	NCH Software Classic FTP		0.03	—	0.02	Jun 27, 2008	Directory traversal vulnerability in the FTP client in NCH Software Classic FTP 1.02 for Windows allows remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) in a response to a LIST command, a related issue to CVE-2002-1345.
CVE-2025-44089	NCH Software ExpressZip	Hig	0.00	8.8	0.00	Jul 22, 2026	An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.
CVE-2010-5220	NCH Software Meo Encryption Software		0.00	—	0.00	Sep 6, 2012	Untrusted search path vulnerability in MEO Encryption Software 2.02 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .meo or .cry file. NOTE: some of these details are…
CVE-2009-4038	Nch Axon Virtual Pbx		0.00	—	0.02	Nov 20, 2009	Multiple cross-site scripting (XSS) vulnerabilities in NCH Software Axon Virtual PBX 2.10 and 2.11 allow remote attackers to inject arbitrary web script or HTML via the (1) onok or (2) oncancel parameter to the logon program. NOTE: the provenance of this information is unknown;…
CVE-2006-4603	NCH Swift Sound Web Dictate		0.00	—	0.02	Sep 7, 2006	NCH Swift Sound Web Dictate 1.02 allows remote attackers to bypass authentication via a null password.

CVE-2021-37444HigJul 25, 2021
NCH Software
Ivm Attendant
risk 0.57cvss 8.8epss 0.02
NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file…
CVE-2020-11561HigApr 7, 2020
NCH Software
Express Invoice
risk 0.57cvss 8.8epss 0.02
In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as the "Add New Item" screen.
CVE-2020-11560HigApr 7, 2020
NCH Software
Express Invoice
risk 0.54cvss 7.8epss 0.01
NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.
CVE-2021-37447HigJul 25, 2021
Nch
Quorum
risk 0.53cvss 8.1epss 0.02
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion.
CVE-2021-37443HigJul 25, 2021
Nch
IVM Attendant
risk 0.53cvss 8.1epss 0.01
NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.
CVE-2021-37445MedJul 25, 2021
Nch
Quorum
risk 0.42cvss 6.5epss 0.01
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading.
CVE-2021-37442MedJul 25, 2021
Nch
IVM Attendant
risk 0.42cvss 6.5epss 0.01
NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files.
CVE-2021-37440MedJul 25, 2021
Nch
Axon Pbx
risk 0.42cvss 6.5epss 0.01
NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.. substring.
CVE-2021-37439MedJul 25, 2021
Nch
Flexiserver
risk 0.42cvss 6.5epss 0.01
NCH FlexiServer v6.00 suffers from a syslog?file=/.. path traversal vulnerability.
CVE-2020-13474MedDec 28, 2020
NCH Software
Express Accounts
risk 0.42cvss 6.5epss 0.01
In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as Add/Edit users.
CVE-2020-13473MedDec 28, 2020
NCH Software
Express Accounts
risk 0.36cvss 5.5epss 0.00
NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration file.
CVE-2021-37449MedJul 25, 2021
Nch
IVM Attendant
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).
CVE-2021-37448MedJul 25, 2021
Nch
IVM Attendant
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).
CVE-2021-37470MedJul 25, 2021
Nch
WebDictate
risk 0.35cvss 5.4epss 0.01
In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript.
CVE-2021-37467MedJul 25, 2021
Nch
Quorum
risk 0.35cvss 5.4epss 0.01
In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).
CVE-2021-37466MedJul 25, 2021
Nch
Quorum
risk 0.35cvss 5.4epss 0.01
In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).
CVE-2021-37465MedJul 25, 2021
Nch
Quorum
risk 0.35cvss 5.4epss 0.01
In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).
CVE-2021-37464MedJul 25, 2021
Nch
Quorum
risk 0.35cvss 5.4epss 0.01
In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).
CVE-2021-37463MedJul 25, 2021
Nch
Quorum
risk 0.35cvss 5.4epss 0.01
In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).
CVE-2021-37462MedJul 25, 2021
Nch
Axon Pbx
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).
CVE-2021-37461MedJul 25, 2021
Nch
Axon Pbx
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).
CVE-2021-37460MedJul 25, 2021
Nch
Axon Pbx
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).
CVE-2021-37459MedJul 25, 2021
Nch
Axon Pbx
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).
CVE-2021-37458MedJul 25, 2021
Nch
Axon Pbx
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).
CVE-2021-37457MedJul 25, 2021
Nch
Axon Pbx
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).
CVE-2021-37456MedJul 25, 2021
Nch
Axon Pbx
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored).
CVE-2021-37455MedJul 25, 2021
Nch
Axon Pbx
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored).
CVE-2021-37454MedJul 25, 2021
Nch
Axon Pbx
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).
CVE-2021-37453MedJul 25, 2021
Nch
Axon Pbx
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).
CVE-2021-37451MedJul 25, 2021
Nch
IVM Attendant
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).
CVE-2021-37450MedJul 25, 2021
Nch
IVM Attendant
risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).
CVE-2019-16330MedOct 17, 2019
NCH Software
Express Accounts Accounting
risk 0.35cvss 5.4epss 0.01
In NCH Express Accounts Accounting v7.02, persistent cross site scripting (XSS) exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject…
CVE-2019-16282MedOct 14, 2019
NCH Software
Express Invoice
risk 0.35cvss 5.4epss 0.01
In NCH Express Invoice v7.12, persistent cross site scripting (XSS) exists via the Invoices/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Items/Customers fields parameter to inject arbitrary JavaScript.
CVE-2020-13476MedDec 28, 2020
NCH Software
Express Invoice
risk 0.31cvss 4.8epss 0.01
NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module.
CVE-2021-37446MedJul 25, 2021
Nch
Quorum
risk 0.28cvss 4.3epss 0.01
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading.
CVE-2008-2894Jun 27, 2008
NCH Software
Classic FTP
risk 0.03cvss —epss 0.02
Directory traversal vulnerability in the FTP client in NCH Software Classic FTP 1.02 for Windows allows remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) in a response to a LIST command, a related issue to CVE-2002-1345.
CVE-2025-44089HigJul 22, 2026
NCH Software
ExpressZip
risk 0.00cvss 8.8epss 0.00
An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.
CVE-2010-5220Sep 6, 2012
NCH Software
Meo Encryption Software
risk 0.00cvss —epss 0.00
Untrusted search path vulnerability in MEO Encryption Software 2.02 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .meo or .cry file. NOTE: some of these details are…
CVE-2009-4038Nov 20, 2009
Nch
Axon Virtual Pbx
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in NCH Software Axon Virtual PBX 2.10 and 2.11 allow remote attackers to inject arbitrary web script or HTML via the (1) onok or (2) oncancel parameter to the logon program. NOTE: the provenance of this information is unknown;…
CVE-2006-4603Sep 7, 2006
NCH Swift Sound
Web Dictate
risk 0.00cvss —epss 0.02
NCH Swift Sound Web Dictate 1.02 allows remote attackers to bypass authentication via a null password.