Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-34104

Guardian Language-System SQL Injection via name Parameter in designer.php

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Guardian language-system passes the name GET parameter directly into an unsanitized SQL query in designer.php (line 124): SELECT * FROM complex WHERE name='\".$_GET['name'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

guardian language-system

Default version status: affected

  • 0 to ≤ e42c395ec4b03fe62973a669c9209a673838b8a4affected
pkg:github/guardian/language-system

References