Which versions of Guardian Language-System are affected by CVE-2026-34104?

Guardian Language-System users face immediate risk of complete data compromise-attackers with low-privilege access can steal, modify, or destroy the entire database using publicly available exploit…

Is there a public PoC exploit available for CVE-2026-34104?

Yes, a public proof-of-concept exploit is available for CVE-2026-34104. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-34104?

Within 24 hours: Immediately implement network access restrictions to designer.php via firewall rules or IP allowlisting; verify the actual authentication requirement for your deployment (CVSS vector indicates low-privilege access is required, but confirm given discrepancies in source advisories). Within 7 days: audit and enforce least-privilege database account permissions; review application logs for exploitation attempts or suspicious SQL patterns; isolate the affected system from production if operationally feasible. Within 30 days: no vendor-released patch identified at time of analysis-evaluate migration to an alternative product with demonstrated patch history, formally request patch timeline from vendor, or deploy persistent WAF rules with SQL injection filtering on the name parameter.

Guardian Language-System CVE-2026-34104

Q: What is the CVSS score of CVE-2026-34104?

CVE-2026-34104 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41061 HIGH

SQL Injection (CWE-89)

2026-07-01 VulnCheck

GHSA-8333-3mcf-q3cc

PHP SQLi Guardian Language System

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable endpoint, no complexity, low-privilege auth per description and PR:L in provided 4.0 vector; scope unchanged as impact stays within the application's database.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 24, 2026 - 11:44 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 24, 2026 - 11:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 24, 2026 - 11:22 vuln.today

cvss_changed

Severity Changed

Aug 24, 2026 - 11:22 NVD

CRITICAL HIGH

CVSS changed

Aug 24, 2026 - 11:22 NVD

9.3 (CRITICAL) 8.7 (HIGH)

Analysis Generated

Jul 01, 2026 - 16:53 vuln.today

DescriptionCVE.org

Guardian language-system passes the name GET parameter directly into an unsanitized SQL query in designer.php (line 124): SELECT * FROM complex WHERE name='\".$_GET['name'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

AnalysisAI

SQL injection in Guardian Language-System's designer.php (line 124) allows attackers to extract, modify, or destroy the full database contents by manipulating the unsanitized name GET parameter passed directly into a raw SQL query. A public proof-of-concept exploit exists via GitHub Gist, and SSVC analysis classifies the attack as automatable with total technical impact. A notable discrepancy exists between sources: the CVE description and the CVSS 4.0 vector (PR:L) indicate low-privilege authentication is required, while the VulnCheck advisory title labels this 'unauthenticated' - defenders must verify the actual authentication requirement before calibrating response priority.

Technical ContextAI

Guardian Language-System is a PHP-based application for managing multilingual content, identified by CPE cpe:2.3:a:guardian:language-system:*:*:*:*:*:*:*:*. The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), the classic SQL injection root cause. At designer.php line 124, the $_GET['name'] superglobal is concatenated directly into a SQL string - SELECT * FROM complex WHERE name='".$_GET['name']."' - with no parameterization, prepared statements, or escaping. The error-based exploitation technique relies on the application returning database error messages to the HTTP response, allowing an attacker to exfiltrate schema and data column-by-column by crafting inputs that trigger structured SQL errors. PHP applications using raw string concatenation for database queries are particularly susceptible because there is no framework-level protection layer enforcing parameterized queries.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - operators should update to any commit after e42c395ec4b03fe62973a669c9209a673838b8a4 from the Guardian Language-System repository and verify the fix is applied to designer.php line 124. The correct long-term fix is to replace the raw string concatenation with a parameterized prepared statement using PHP's PDO or MySQLi extension. As an immediate compensating control, restrict access to designer.php via web server configuration (e.g., Apache .htaccess or nginx location block) to trusted IP ranges only - this eliminates network exposure but may break legitimate designer functionality for remote users. Alternatively, place an authenticated reverse proxy or WAF with SQL injection signatures in front of the application; WAF rules can block obvious error-based payloads but should not be treated as a permanent substitute for code-level remediation. Consult the VulnCheck advisory at https://www.vulncheck.com/advisories/guardian-language-system-unauthenticated-sql-injection-via-name-parameter-in-designer-php and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-34104 for any updated vendor guidance.