In NCH Quorum v2.03 and previous versions, XSS exists via /conferencebrowseuploadfile?confid= (reflected).
nchsoftware quorum