# CVEs published 2018-05-05

5 CVEs were published on May 5, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-10723](https://cve.now/CVE-2018-10723.md): Directus 6.4.9 has a hardcoded admin password for the Admin account because of an INSERT statement in api/schema.sql. (no CVSS)
- [CVE-2018-10757](https://cve.now/CVE-2018-10757.md): CSP MySQL User Manager 2.3.1 allows SQL injection, and resultant Authentication Bypass, via a crafted username during a login attempt. (no CVSS)
- [CVE-2018-10758](https://cve.now/CVE-2018-10758.md): The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles. (no CVSS)
- [CVE-2018-10752](https://cve.now/CVE-2018-10752.md): The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action. (no CVSS)
- [CVE-2018-10753](https://cve.now/CVE-2018-10753.md): Stack-based buffer overflow in the delayed\_output function in music.c in abcm2ps through 8.13.20 allows remote attackers to cause a denial… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2018-05-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.