WordPress Classified Listing plugin < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification vulnerability

Subscriber+ Unattached Media Deletion and Modification vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Classified Listing versions 6.1.1...

CVE-2026-106646

The Classified Listing WordPress plugin (versions before 6.1.1 ) contains a vulnerability where it fails to verify requester ownership or editing permissions for target listings when a gallery request references an unattached media item . This flaw allows any authenticated user with a subscriber-...

CVE-2021-24730

The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswsssaveattachmentdata AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media...

DEBIAN-CVE-2014-1685

The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via unspecified vectors...

CVE-2014-1685

The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via unspecified vectors...

PT-2014-4292

Name of the Vulnerable Software and Affected Versions Zabbix versions prior to 1.8.20rc2 Zabbix versions 2.0.x prior to 2.0.11rc2 Zabbix versions 2.2.x prior to 2.2.2rc1 Description The issue allows remote "Zabbix Admin" users to modify the media of arbitrary users. Recommendations For versions...