# CVEs published 2018-04-28

3 CVEs were published on April 28, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-10527](https://cve.now/CVE-2018-10527.md): EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated (no CVSS)
- [CVE-2018-10468](https://cve.now/CVE-2018-10468.md): The transferFrom function of a smart contract implementation for Useless Ethereum Token (UET), an Ethereum ERC20 token, allows attackers to (no CVSS)
- [CVE-2017-18263](https://cve.now/CVE-2017-18263.md): Seagate Media Server in Seagate Personal Cloud before 4.3.18.4 has directory traversal in getPhotoPlaylistPhotos.psp via a parameter named u (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-04-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.