# CVEs published 2018-04-22 10 CVEs were published on April 22, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2017-17889](https://cve.now/CVE-2017-17889.md): Kliqqi CMS 3.5.2 has XSS via a crafted group name in pligg/groups.php, a crafted Homepage string in a profile, or a crafted string in Tags o (no CVSS) - [CVE-2017-17902](https://cve.now/CVE-2017-17902.md): SQL Injection exists in Kliqqi CMS 3.5.2 via the randkey parameter of a new story at the pligg/story.php?title= URI. (no CVSS) - [CVE-2018-10297](https://cve.now/CVE-2018-10297.md): Discuz! DiscuzX through X3.4 has stored XSS via the portal.php?mod=portalcp&ac=article URI, related to mishandling of IMG elements associate (no CVSS) - [CVE-2018-10298](https://cve.now/CVE-2018-10298.md): Discuz! DiscuzX through X3.4 has reflected XSS via forum.php?mod=post&action=newthread because data/template/1\_diy\_portal\_view.tpl.php does (no CVSS) - [CVE-2018-10295](https://cve.now/CVE-2018-10295.md): ChemCMS v1.0.6 has CSRF by using public/admin/user/addpost.html to add an administrator account. (no CVSS) - [CVE-2018-10296](https://cve.now/CVE-2018-10296.md): MiniCMS V1.10 has XSS via the mc-admin/post-edit.php title parameter. (no CVSS) - [CVE-2018-10285](https://cve.now/CVE-2018-10285.md): The Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. (no CVSS) - [CVE-2018-10286](https://cve.now/CVE-2018-10286.md): The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and the PostgreSQL databas (no CVSS) - [CVE-2018-9245](https://cve.now/CVE-2018-9245.md): The Ericsson-LG iPECS NMS A.1Ac login portal has a SQL injection vulnerability in the User ID and password fields that allows users to bypas (no CVSS) - [CVE-2018-10289](https://cve.now/CVE-2018-10289.md): In MuPDF 1.13.0, there is an infinite loop in the fz\_skip\_space function of the pdf/pdf-xref.c file. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-04-22 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.