Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2015-3314: Tune Library plugin could let attackers steal data
CVE-2015-3314 · published 9 years ago
Summary
The Tune Library plugin for WordPress (versions before 1.5.5) lets a malicious user add harmful commands that can read or change your website's information. This could expose sensitive data or let the site be altered without permission. Update the plugin to version 1.5.5 or later, or remove it if you do not need the functionality.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| tune_library_project | tune_library |
<= 1.5.4 cpe:2.3:a:tune_library_project:tune_library:*:*:*:*:*:wordpress:*:* |
Original advisory text
SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.
SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.
References
- http://packetstormsecurity.com/files/131558/WordPress-Tune-Library-1.5.4-SQL-Inj... Exploit Third Party Advisory VDB Entry
- http://www.openwall.com/lists/oss-security/2015/04/16/10 Mailing List Third Party Advisory
- http://www.openwall.com/lists/oss-security/2015/05/08/3 Mailing List Third Party Advisory
- http://www.securityfocus.com/bid/74236 Third Party Advisory VDB Entry
- https://wordpress.org/plugins/tune-library/#developers Third Party Advisory
- https://www.exploit-db.com/exploits/36802/ Exploit Third Party Advisory VDB Entry
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-89SQL Injection
Timeline
Published7 Sep 2017
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-3314 · NVD
Track software like this
Free during beta