CVE-2026-34106

Guardian Language-System is affected by an unauthenticated OS command injection in subtitles.php. The id GET parameter is directly concatenated into a PHP exec() call without sanitization, enabling remote attackers to inject shell metacharacters and execute arbitrary commands on the server. The v...

CVE-2022-46889

CVE-2022-46889 affects NexusPHP prior to 1.7.33, with a persistent XSS in the title parameter of /subtitles.php exploited by remote authenticated attackers to inject arbitrary script/HTML. The issue is mitigated by upgrading to version 1.7.33 or later (see PT-2023-15096). Exploitation status is n...