# CVEs published 2018-04-15

7 CVEs were published on April 15, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-10121](https://cve.now/CVE-2018-10121.md): plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and en (no CVSS)
- [CVE-2018-10119](https://cve.now/CVE-2018-10119.md): sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm (no CVSS)
- [CVE-2018-10120](https://cve.now/CVE-2018-10120.md): The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validat (no CVSS)
- [CVE-2018-9153](https://cve.now/CVE-2018-9153.md): The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the app\_id parameter to zb\_users/pl (no CVSS)
- [CVE-2018-9169](https://cve.now/CVE-2018-9169.md): Z-BlogPHP 1.5.1 has XSS via the zb\_users/plugin/AppCentre/plugin\_edit.php app\_id parameter. (no CVSS)
- [CVE-2018-10118](https://cve.now/CVE-2018-10118.md): Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins (no CVSS)
- [CVE-2018-10117](https://cve.now/CVE-2018-10117.md): An issue was discovered in idreamsoft iCMS V7.0.7. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-04-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.