CVE-2018-7303

The Calendar component in Tiki 17.1 allows HTML injection.