CVE Feed

    Dashboard / CVE / CVE-2026-34098

    CVE-2026-34098

    Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action attributes in media.php (lines 119, 129). An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session.

    Published:Jul 1, 2026
    Last Modified:Jul 6, 2026
    EPS:Jul 1, 2026
    EPSS Score:0.00147
    CVSS Score:4.6

    Affected Products

    Vendor
    Guardian
    Product
    Language-system

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-34117 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in text_to_subtitles.php …
    CVE-2026-34116 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe.php (line 1…
    CVE-2026-34115 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe_amazon.php …
    CVE-2026-34114 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate_text.php (li…
    CVE-2026-34113 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech_text.php (line …
    CVE-2026-34112 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac.php (line 18…
    CVE-2026-34111 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac_text.php (li…
    CVE-2026-34110 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in complex_start.php (lin…
    CVE-2026-34109 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech.php (line 18) w…
    CVE-2026-34108 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in text.php (line 15) wit…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High