# CVEs published 2018-11-11 9 CVEs were published on November 11, 2018: 0 critical, 0 high. Days are UTC. - [CVE-2018-19180](https://cve.now/CVE-2018-19180.md): statics/app/index/controller/Install.php in YUNUCMS 1.1.5 (if install.lock is not present) allows remote attackers to execute arbitrary PHP (no CVSS) - [CVE-2018-19181](https://cve.now/CVE-2018-19181.md): statics/ueditor/php/vendor/Local.class.php in YUNUCMS 1.1.5 allows arbitrary file deletion via the statics/ueditor/php/controller.php?action (no CVSS) - [CVE-2018-19178](https://cve.now/CVE-2018-19178.md): In JEESNS 1.3, com/lxinet/jeesns/core/utils/XssHttpServletRequestWrapper.java allows stored XSS via an HTML EMBED element, a different vulne (no CVSS) - [CVE-2018-19141](https://cve.now/CVE-2018-19141.md): Open Ticket Request System (OTRS) 4.0.x before 4.0.33 and 5.0.x before 5.0.31 allows an admin to conduct an XSS attack via a modified URL be (no CVSS) - [CVE-2018-19142](https://cve.now/CVE-2018-19142.md): Open Ticket Request System (OTRS) 6.0.x before 6.0.13 allows an admin to conduct an XSS attack via a modified URL. (no CVSS) - [CVE-2018-19143](https://cve.now/CVE-2018-19143.md): Open Ticket Request System (OTRS) 4.0.x before 4.0.33, 5.0.x before 5.0.31, and 6.0.x before 6.0.13 allows an authenticated user to delete f (no CVSS) - [CVE-2018-19170](https://cve.now/CVE-2018-19170.md): In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrat (no CVSS) - [CVE-2018-19135](https://cve.now/CVE-2018-19135.md): ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default). (no CVSS) - [CVE-2018-19168](https://cve.now/CVE-2018-19168.md): Shell Metacharacter Injection in www/modules/save.php in FruityWifi (aka PatatasFritas/PatataWifi) through 2.4 allows remote attackers to ex (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2018-11-11 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.