CVE-2021-37470: Nchsoftware Webdictate

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript.

Affected products

• Nchsoftware Webdictate: up to and including 2.13

Published 2021-07-25. Last modified 2026-06-17.