CVE-2026-34106

creationtimestamp| type| source ---|---|--- 2026-07-01 17:21:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplzpzlhhm26 2026-07-02 08:27:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnmej5alh2u...

CVE-2026-34106

Guardian language-system passes the id GET parameter directly into a PHP exec call in subtitles.php line 19 without sanitization: exec"php jobs/subtitlerendering.php ".$loginsession." ".$GET'id'." ...". No authentication is required. An unauthenticated remote attacker can append shell...

CVE-2026-34106

Guardian Language-System is affected by an unauthenticated OS command injection in subtitles.php. The id GET parameter is directly concatenated into a PHP exec() call without sanitization, enabling remote attackers to inject shell metacharacters and execute arbitrary commands on the server. The v...