# CVEs published 2018-04-07 10 CVEs were published on April 7, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2018-9325](https://cve.now/CVE-2018-9325.md): Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledge of pad names. (no CVSS) - [CVE-2018-9326](https://cve.now/CVE-2018-9326.md): Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code. (no CVSS) - [CVE-2018-9327](https://cve.now/CVE-2018-9327.md): Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. (no CVSS) - [CVE-2018-9846](https://cve.now/CVE-2018-9846.md): In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-co (no CVSS) - [CVE-2018-9847](https://cve.now/CVE-2018-9847.md): In Gxlcms QY v1.0.0713, the update function in Lib\\Lib\\Action\\Admin\\TplAction.class.php allows remote attackers to execute arbitrary PHP cod (no CVSS) - [CVE-2018-9848](https://cve.now/CVE-2018-9848.md): In Gxlcms QY v1.0.0713, the upload function in Lib\\Lib\\Action\\Admin\\UploadAction.class.php allows remote attackers to execute arbitrary PHP (no CVSS) - [CVE-2018-9330](https://cve.now/CVE-2018-9330.md): register.jsp in Coremail XT3.0 allows stored XSS, as demonstrated by the third form field to a URI under register/, a different vulnerabilit (no CVSS) - [CVE-2018-9841](https://cve.now/CVE-2018-9841.md): The export function in libavfilter/vf\_signature.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out-of-array (no CVSS) - [CVE-2018-9844](https://cve.now/CVE-2018-9844.md): The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS. (no CVSS) - [CVE-2018-9331](https://cve.now/CVE-2018-9331.md): An issue was discovered in zzcms 8.2. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-04-07 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.