PT-2026-54733 · Guardian · Language-System

Philopentest · Published 2026-07-01 · Updated 2026-07-01 · CVE-2026-34097

NVD

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in text file.php (lines 94, 101, 323, 403, 826, 852). An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-34097

Affected Products

Language-System

References · 3

• 🔥 https://gist.github.com/cyberinforepo/d5b2771d82e1b31b8fc1c33052e08dad · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34097 · Security Note
• https://vulncheck.com/advisories/guardian-language-system-xss-via-text-file-php-id-parameter · Note