CVE-2026-34099
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
An SQL injection vulnerability in Guardian language-system allows an unauthenticated attacker to inject SQL code via the id parameter in job_info.php. Lack of input sanitization enables extraction of database version, current user, schema names, and table contents.
Risk Assessment
The organization is at risk of sensitive data leakage from the database, including credentials and user information, potentially leading to confidentiality and integrity breaches.
Recommendation
Immediately implement parameterized SQL queries or proper input validation for the id parameter in job_info.php, and restrict access to this file to authenticated users only.
Original NVD description (English source)
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info.php (line 16): SELECT * FROM jobs where id = '\".$_GET['id'].\"'. No authentication is required. An unauthenticated attacker can perform error-based SQL injection to extract the database version, current user, schema names, and table contents.