CVE-2026-34105
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
SQL Injection vulnerability in Guardian language-system allows an authenticated attacker to inject SQL code via the id parameter in translate_text.php. Lack of input sanitization enables extraction of database contents.
Risk Assessment
An attacker can exfiltrate sensitive database data, including passwords, user details, or other confidential information, compromising system confidentiality and integrity.
Recommendation
Immediately update Guardian language-system to the latest patched version. If unavailable, use parameterized SQL queries or input validation for the id parameter.
Original NVD description (English source)
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in translate_text.php (line 15): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.