# CVEs published 2018-05-05

5 CVEs were published on May 5, 2018: 0 critical, 0 high. Days are UTC.

- [CVE-2018-10723](https://cve.now/CVE-2018-10723.md): Directus 6.4.9 has a hardcoded admin password for the Admin account because of an INSERT statement in api/schema.sql. (no CVSS)
- [CVE-2018-10757](https://cve.now/CVE-2018-10757.md): CSP MySQL User Manager 2.3.1 allows SQL injection, and resultant Authentication Bypass, via a crafted username during a login attempt. (no CVSS)
- [CVE-2018-10758](https://cve.now/CVE-2018-10758.md): The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles. (no CVSS)
- [CVE-2018-10752](https://cve.now/CVE-2018-10752.md): The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action. (no CVSS)
- [CVE-2018-10753](https://cve.now/CVE-2018-10753.md): Stack-based buffer overflow in the delayed\_output function in music.c in abcm2ps through 8.13.20 allows remote attackers to cause a denial o (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-05-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.