CVE-2026-34102
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
An SQL injection vulnerability in Guardian language-system allows an authenticated attacker to inject malicious SQL via the 'id' parameter in job_info_get.php. Unsanitized input enables error-based SQL injection to extract database contents.
Risk Assessment
An attacker can exfiltrate sensitive database contents, including credentials and job data, leading to confidentiality and integrity breaches.
Recommendation
Immediately update Guardian language-system to a patched version or implement parameterized SQL queries (prepared statements) in job_info_get.php.
Original NVD description (English source)
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info_get.php (line 16): SELECT * FROM jobs where input1 = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.