$CVE-2026-34103 CVE Vulnerability Disclosures / 1d Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php (line 16): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.$

Back cve.report

CVE-2026-34103 CVE Vulnerability Disclosures / 1d Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php (line 16): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

cve.report • July 3, 2026

Share: View original

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS: 0.003730000 probability, percentile 0.292280000 (date 2026-07-02)

Problem Types: CWE-89 | CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: philopentest (en)

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerabilities Discovered in Guardian Language-System Two critical SQL injection vulnerabilities, CVE-2026-34105 and CVE-2026-34103, were identified in the Guardian language-system, affecting the translate_text.php and subtitles.php files respectively. Both vulnerabilities allow authenticated attackers to execute error-based SQL injection attacks, enabling them to extract, modify, or delete sensitive data from the database. No public proof-of-concept or confirmed exploitation has been reported yet. Patches for both vulnerabilities are available, and security experts recommend immediate implementation of parameterized queries and input validation to mitigate risks. The vulnerabilities received CVSS scores of 9.8 and 9.8, indicating their high severity. Organizations using the Guardian language-system are urged to update their systems promptly to prevent potential data breaches. 2 sources 72

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)