PT-2026-54733 · Guardian · Language-System

Philopentest · Publicado 2026-07-01 · Atualizado 2026-07-01 · CVE-2026-34097

NVD

CVSS v3.1

4.6

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in text file.php (lines 94, 101, 323, 403, 826, 852). An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-34097

Produtos afetados

Language-System

Referências · 3

• 🔥 https://gist.github.com/cyberinforepo/d5b2771d82e1b31b8fc1c33052e08dad · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34097 · Nota de Segurança
• https://vulncheck.com/advisories/guardian-language-system-xss-via-text-file-php-id-parameter · Nota