CVE Feed

    Dashboard / CVE / CVE-2026-34099

    CVE-2026-34099

    Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info.php (line 16): SELECT * FROM jobs where id = '\".$_GET['id'].\"'. No authentication is required. An unauthenticated attacker can perform error-based SQL injection to extract the database version, current user, schema names, and table contents.

    Published:Jul 1, 2026
    Last Modified:Jul 6, 2026
    EPS:Jul 1, 2026
    EPSS Score:0.00459
    CVSS Score:9.8

    Affected Products

    Vendor
    Guardian
    Product
    Language-system

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-34117 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in text_to_subtitles.php …
    CVE-2026-34116 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe.php (line 1…
    CVE-2026-34115 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe_amazon.php …
    CVE-2026-34114 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate_text.php (li…
    CVE-2026-34113 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech_text.php (line …
    CVE-2026-34112 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac.php (line 18…
    CVE-2026-34111 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac_text.php (li…
    CVE-2026-34110 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in complex_start.php (lin…
    CVE-2026-34109 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech.php (line 18) w…
    CVE-2026-34108 (CVSS 9.3) — Guardian language-system passes the id GET parameter directly into a PHP exec() call in text.php (line 15) wit…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High