Guardian Language-System CVE-2026-34105

Based on the CVE description and CVSS 4.0 PR:L vector, exploitation requires a valid authenticated session in the Guardian Language-System application (low-privilege account). The vulnerable endpoint translate_text.php must be reachable over the network (AV:N) and the attacker must be able to issue HTTP GET requests with a controlled id parameter. No special non-default configuration is required beyond the application being deployed and accessible. CRITICAL CONFLICT: the VulnCheck advisory title labels this 'unauthenticated SQL injection,' which directly contradicts the CVE description's 'authenticated attacker' wording and the CVSS PR:L metric. If authentication is not required, the exploitation condition simplifies to any remote party with network access to translate_text.php. Defenders must verify the true authentication requirement from the vendor or by testing the POC before making access-control decisions based on this field.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) places this at 8.7, reflecting low-complexity network exploitation with full confidentiality, integrity, and availability impact on the vulnerable system and no scope change to subsequent systems. The SSVC assessment (Exploitation: poc, Automatable: yes, Technical Impact: total) signals that tooling could automate this attack at scale once an attacker is authenticated. However, EPSS at 0.37% (29th percentile) indicates that, despite POC availability, active exploitation is not widespread - consistent with the niche footprint of the product. The CVE is not in CISA KEV. A key unresolved conflict exists: the CVE description states 'authenticated attacker' while the CVSS PR:L vector corroborates this, yet the VulnCheck advisory URL explicitly labels this as 'unauthenticated SQL injection.' If the latter is correct, exploitability increases dramatically (PR:N) and the real-world risk profile would be considerably worse. Defenders should verify the authentication requirement directly against the advisory before assigning remediation priority.

An attacker with low-privilege credentials to the Guardian Language-System application submits a crafted GET request to translate_text.php with a malicious id value such as ' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT password FROM users LIMIT 1)))-- -, triggering an error-based SQL response that reveals database row contents in the HTTP error message. A publicly available proof-of-concept on GitHub (https://gist.github.com/cyberinforepo/d5b2771d82e1b31b8fc1c33052e08dad) demonstrates this technique, enabling automated enumeration of the full database schema and data with minimal manual effort.