EUVD-2026-41056
GHSA-gpmw-jvm3-5xc2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed job_info.php endpoint
-
DeliveryInject payload into id GET parameter
-
ExploitBreak out of SQL string literal
-
ExecutionTrigger error-based SQL injection
-
ImpactExtract version, user, schema, table data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The only prerequisite is network reachability to the job_info.php endpoint of a Guardian Language System deployment; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote, unauthenticated, and requires no user interaction against default configurations. The specific trigger is supplying a crafted value in the |
| Impact | All available signals point to a genuine high priority rather than an inflated CVSS. The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H describes a network-reachable, low-complexity, unauthenticated attack with high impact to confidentiality, integrity and availability of the vulnerable system, scoring 9.3. Publicly available exploit code (a gist) further lowers the barrier to exploitation, and the flaw was surfaced by a credible source (VulnCheck). Countervailing signals: it is NOT listed in CISA KEV, so there is no confirmation of active in-the-wild exploitation, and no EPSS score was provided in the input, so widespread automated scanning cannot be quantified from this data. The main uncertainty is deployment footprint - Guardian Language System appears to be an obscure product, which likely limits the total attack surface even though any exposed instance is trivially exploitable. |
| Exploit ScenarioDerived | An attacker discovers a Guardian Language System instance and requests job_info.php?id=1' followed by an error-based injection payload, causing the database to return version and schema data in error messages. Using the publicly available exploit gist, they iterate to dump user tables and credentials without ever authenticating. Because attack complexity is low and no user interaction is needed, this can be automated across many exposed hosts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Unauthenticated SQL injection in Guardian Language System lets remote attackers manipulate the backend database by injecting into the id GET parameter of job_info.php, which is concatenated directly into a SQL query with no sanitization. Because no authentication is required (CVSS 4.0 PR:N) and publicly available exploit code exists, any attacker who can reach the endpoint can extract database version, current user, schema names, and table contents via error-based injection. Reported by VulnCheck with a CVSS of 9.3; no public exploit identified as actively used in the wild (not in CISA KEV).
RemediationAI
No vendor-released patch version was identified in the available data, so remediation should focus on both code fixes and compensating controls. The definitive fix is to rewrite the job_info.php query to use a parameterized/prepared statement (e.g., PDO or mysqli bound parameters) so the id value is never concatenated into SQL, and to cast id to an integer if it is expected to be numeric. Until a fix is deployed, restrict access to job_info.php at the web server or WAF layer, add a WAF rule to reject SQL metacharacters in the id parameter, disable verbose database error output to blunt the error-based extraction technique (trade-off: reduces debugging visibility), and place the application behind authentication or network ACLs to remove unauthenticated exposure (trade-off: may break legitimate anonymous access to job listings). Consult the VulnCheck advisory at https://www.vulncheck.com/advisories/guardian-language-system-unauthenticated-sql-injection-via-id-parameter-in-job-info-php for updates on an official patched release.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a PHP web application (cpe:2.3:a:guardian:language-system) that builds SQL statements through raw string concatenation. Specifically, job_info.php line 16 executes SELECT * FROM jobs where id = '".$_GET['id']."', embedding attacker-controlled input inside a single-quoted string literal without parameterization or escaping. This is a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) defect: the application trusts a client-supplied GET parameter as trusted SQL syntax, allowing an attacker to break out of the quoted context and append arbitrary SQL clauses. The error-based technique referenced in the description implies the application surfaces database error output, which accelerates data extraction (UNION/error functions returning version(), current_user, information_schema contents).
Know when Guardian gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network-reachable GET parameter with trivial payload gives AV:N/AC:L/PR:N/UI:N; full database read/write/erase via SQLi justifies C:H/I:H/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info.php (line 16): SELECT * FROM jobs where id = '\".$_GET['id'].\"'. No authentication is required. An unauthenticated attacker can perform error-based SQL injection to extract the database version, current user, schema names, and table contents.
Articles & Coverage 1
Executive ViewAI
Guardian Language System contains a critical SQL injection vulnerability (CVE-2026-34099) enabling unauthenticated remote attackers to extract sensitive database contents without authentication. With publicly available exploit code in circulation and no vendor patch currently available, any internet-exposed instance represents an immediate threat to data confidentiality and regulatory compliance. Organizations must immediately identify affected systems and implement emergency mitigations to prevent unauthorized database access.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to job_info.php endpoint via firewall or WAF to authorized internal IP ranges only; (2) Enforce principle-of-least-privilege on database service accounts to limit query scope and data exposure; (3) Deploy SQL injection detection signatures in intrusion prevention systems; (4) Enable and actively monitor database audit logs for suspicious query patterns and unauthorized access; (5) If internet-facing and business-critical, isolate service offline or evaluate patched alternative solutions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
OS command injection in Guardian language-system lets unauthenticated remote attackers run arbitrary shell commands by i
Remote code execution in Guardian language-system allows unauthenticated attackers to run arbitrary OS commands by injec
Error-based SQL injection in Guardian Language-System allows a network-accessible authenticated attacker to extract the
SQL injection in Guardian Language-System's designer.php (line 124) allows attackers to extract, modify, or destroy the
Error-based SQL injection in Guardian language-system's subtitles.php exposes full database contents to low-privileged a
Error-based SQL injection in Guardian Language-System exposes the full database to low-privileged authenticated attacker
Error-based SQL injection in Guardian language-system's text_file.php exposes the full database to extraction via a triv
SQL injection in Guardian language-system's media.php endpoint allows low-privilege authenticated attackers to extract t
Nozomi Networks OS before 19.0.4 allows /#/network?tab=network_node_list.html CSV Injection. Rated high severity (CVSS 7
Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to
A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields us
Reflected cross-site scripting in Guardian Language-System's media.php allows authenticated attackers to inject arbitrar
Exploit-DB