CVE-2026-34103
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
An SQL injection vulnerability in the Guardian language-system allows an authenticated attacker to inject malicious SQL code via the GET parameter 'id' in subtitles.php. Lack of input sanitization enables error-based SQL injection to extract database contents.
Risk Assessment
An attacker can exfiltrate sensitive data from the database, including user data or other confidential information, leading to a breach of confidentiality and system integrity.
Recommendation
Immediately update Guardian language-system to the latest patched version. As a temporary measure, use parameterized SQL queries or validate the 'id' parameter input.
Original NVD description (English source)
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php (line 16): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.