Guardian Language-System EUVD-2026-41059

Exploitation requires the attacker to hold a low-privilege authenticated session on the Guardian Language-System application, as confirmed by the CVSS 4.0 PR:L metric and the CVE description stating 'authenticated attacker'. The vulnerable endpoint job_info_get.php must be reachable over the network (AV:N). No additional attack requirements apply (AT:N), and no victim interaction is needed (UI:N). A critical caveat: the VulnCheck advisory URL title labels this 'unauthenticated' - this conflicts with the CVE description and CVSS PR:L; until the vendor clarifies, defenders should assume authentication is required but verify. Exploitation is not constrained by non-default configuration: the vulnerable code path is in the core application file and active by default. Limiting factors are therefore: possession of valid credentials and network access to the endpoint.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) signals a high-severity, network-reachable flaw with low complexity and full confidentiality, integrity, and availability impact - yet EPSS sits at just 0.37% (29th percentile), suggesting mass exploitation has not materialized despite the public POC. No CISA KEV listing has been identified. The disconnect between a public exploit, SSVC Automatable:Yes/Technical Impact:Total, and the low EPSS is notable: it likely reflects the product's limited deployment footprint rather than any technical barrier to exploitation. SSVC's Automatable:Yes rating means that once the POC is in use, mass scanning and extraction are feasible, so even smaller or niche deployments face real risk. A critical discrepancy exists in the source data: the VulnCheck advisory URL describes this as 'unauthenticated' SQL injection, while the CVE description explicitly states 'authenticated attacker' and the CVSS 4.0 PR:L metric confirms low-privilege authentication is required - defenders should treat PR:L as the confirmed baseline and verify directly with the vendor. No patch version has been confirmed, which elevates urgency for compensating controls.

An attacker with a low-privilege account on the Guardian Language-System application sends a crafted GET request such as job_info_get.php?id=' to trigger a SQL error, then iterates payloads using a tool like sqlmap - or the specific public POC at https://gist.github.com/cyberinforepo/d5b2771d82e1b31b8fc1c33052e08dad - to enumerate database tables and extract contents including user credentials and application data. Because the attack requires only a valid low-privilege session and is network-accessible with no interaction from other users, it can be executed quickly and with minimal skill.