In NCH Quorum v2.03 and previous versions, XSS exists via /uploaddoc?id= (reflected).
nchsoftware quorum