EUVD-2026-41054
GHSA-q7ff-88r7-jcwv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered reflected XSS requiring authenticated attacker (PR:L) and victim interaction (UI:R), with scope change to victim browser causing limited confidentiality and integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action attributes in media.php (lines 119, 129). An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session.
AnalysisAI
Reflected cross-site scripting in Guardian Language-System's media.php allows authenticated attackers to inject arbitrary JavaScript into the victim's browser session by crafting a malicious URL with a script payload in the id GET parameter. The flaw exists because the id parameter is written unsanitized directly into HTML source and form action attributes at lines 119 and 129 of media.php. A publicly available proof-of-concept exploit exists on GitHub, though no KEV listing indicates broad active exploitation at time of analysis.
Technical ContextAI
Guardian Language-System is a PHP web application (cpe:2.3:a:guardian:language-system:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting). Specifically, the id value supplied via HTTP GET is interpolated directly into two distinct HTML rendering contexts in media.php: an inline HTML element context (line 119) and a form action attribute context (line 129). Neither insertion point applies HTML entity encoding, HTML attribute escaping, or any other output sanitization, meaning angle brackets and quotes in attacker-supplied input are treated as literal markup by the browser. Injection into a form action attribute is particularly noteworthy because it can redirect form submissions to an attacker-controlled endpoint even without script tag execution, offering a secondary phishing vector.
RemediationAI
No vendor-released patch or fixed version has been identified at time of analysis; the CPE wildcard covers all versions without a bounded upper limit and no advisory references a corrective release. The primary fix requires applying proper output encoding to the id GET parameter before it is written into HTML contexts in media.php at lines 119 and 129 - specifically, htmlspecialchars() with ENT_QUOTES and the application's character encoding should be applied at each insertion point. As a compensating control where code modification is not immediately possible, deploying a Web Application Firewall rule to block script injection patterns (angle brackets, javascript: URI schemes, event handler attributes) in the id parameter can reduce exposure with minimal application side effects. Access to media.php should also be restricted to the minimum required user roles via application-level authorization controls, reducing the pool of potential attackers. Monitor the VulnCheck advisory at https://www.vulncheck.com/advisories/guardian-language-system-xss-via-id-parameter-in-media-php for patch release updates.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today