CVE-2015-3314: tune_library_project tune_library SQL Injection

CVSS: 9.8v3.1CriticalModified

Published 07-09-2017Last modified 06-08-2024

Vulnerability summary

CVE-2015-3314 is a critical (CVSS 9.8) SQL Injection vulnerability in tune_library_project tune_library. EPSS estimates a 4.87% chance of exploitation in the next 30 days, higher than 91.9% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (wordfence)

EPSS score

4.87%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference, exploit-database

Timeline

07-09-2017
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.

CVSS metrics

3 scores · 2 sources · 3 versions

v3.19.8v3.08.1v2.06.8

EPSS trend

Probability

4.87%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

0.00 pp

From 4.87% on 19-09-2026

19-09-202619-10-2026

EPSS score

4.87%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databasephpUnverified
WordPress Plugin Tune Library 1.5.4 - SQL Injection
Maturity: poc

Weaknesses

CWE · root cause

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected systems

Tune_library_project1 product

tune_library≤ 1.5.4

Wordpress1 product

tune-library< 1.5.5

2 vendors · 2 products

References

7 links

wordpress.org/plugins/tune-library/X Refsource CONFIRMThird Party Advisory
packetstormsecurity.com/files/131558/WordPress-Tune-Library-1.5.4-SQL-Injection.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
www.openwall.com/lists/oss-security/2015/05/08/3Mailing ListX Refsource MLISTThird Party Advisory
www.securityfocus.com/bid/74236VDB EntryX Refsource BIDThird Party Advisory
www.openwall.com/lists/oss-security/2015/04/16/10Mailing ListX Refsource MLISTThird Party Advisory
www.exploit-db.com/exploits/36802/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.wordfence.com/threat-intel/vulnerabilities/id/23aa8a2f-9238-4d93-b2d2-de7838ccb156Vendor Advisory

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities