EXPOSURES › CVE-2026-34100
CVE-2026-34100
CRITICAL
DETAIL
SourceNVD · cve
Published2026-07-01
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-34100 ↗
SHAME 35/100
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL inje
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
DESCRIPTION
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.
AFFECTED FEDRAMP PRODUCTS · 0
No correlated FedRAMP products.