Is there a public PoC exploit available for EUVD-2026-41053?

Yes, a public proof-of-concept exploit is available for EUVD-2026-41053. Prioritise patching immediately. EPSS: 0.1%.

Guardian Language-System EUVD-2026-41053

Q: What is the CVSS score of EUVD-2026-41053?

EUVD-2026-41053 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-34097 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 VulnCheck

GHSA-92fw-jg6p-568q

PHP XSS Guardian Language System

4.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Requires authenticated attacker (PR:L) and victim interaction (UI:R); scope changes (S:C) as script executes in victim's browser; no availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:56 vuln.today

DescriptionCVE.org

Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in text_file.php (lines 94, 101, 323, 403, 826, 852). An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session.

AnalysisAI

Reflected XSS in Guardian Language-System's text_file.php allows an authenticated attacker to inject arbitrary script tags into at least six distinct form action attributes (lines 94, 101, 323, 403, 826, 852) by crafting a malicious URL with a payload in the id GET parameter. When a second authenticated victim is socially engineered into following the crafted link, the script executes within their browser session against the Guardian Language-System origin, enabling session token theft or unauthorized actions on the victim's behalf. A publicly available proof-of-concept exploit exists on GitHub; no CISA KEV listing has been identified, meaning active exploitation is not confirmed at time of analysis.

Technical ContextAI

Guardian Language-System is a PHP web application identified by CPE cpe:2.3:a:guardian:language-system:*:*:*:*:*:*:*:*. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting). Specifically, the application reflects the id GET parameter directly into HTML form action attributes in text_file.php without applying PHP output encoding functions such as htmlspecialchars() with ENT_QUOTES. Because the injection point is an HTML attribute value, an attacker can break out of the attribute context using quote characters and inject script tags or event handlers. The multiplicity of injection sites (at least six across the same file) suggests a systemic absence of output encoding rather than a single oversight, implying other parameters or files may carry similar risks.

RemediationAI

No vendor-released patch has been identified at time of analysis; the CPE wildcard and absence of a fix version in any reference confirm this. The correct long-term fix is to apply htmlspecialchars($id, ENT_QUOTES, 'UTF-8') before reflecting the id parameter into any HTML attribute context in text_file.php. As an immediate compensating control, restrict access to text_file.php to the minimum required user roles via server-side ACLs (Apache .htaccess, nginx location blocks, or application-layer middleware) - this limits the pool of potential attackers but does not eliminate the flaw if privileged users are targeted. Deploying a WAF rule to block requests where the id parameter contains HTML metacharacters (quotes, angle brackets, script keywords) can reduce exploitation attempts, though WAF bypass is possible with encoding tricks. Monitor the VulnCheck advisory at https://www.vulncheck.com/advisories/guardian-language-system-xss-via-text-file-php-id-parameter and the POC gist at https://gist.github.com/cyberinforepo/d5b2771d82e1b31b8fc1c33052e08dad for patch or bypass developments.