The guardian language-system contains an SQL injection vulnerability (CVE-2026-34105) due to improper neutralization of special elements in the id GET parameter used in translate_text.php. The parameter is directly concatenated into an SQL query without sanitization, enabling an unauthenticated attacker to perform error-based SQL injection attacks to extract sensitive database information. The vulnerability is rated critical with a CVSS 4.0 score of 9.3, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available.

An unauthenticated attacker can exploit this vulnerability to perform error-based SQL injection, potentially extracting sensitive database contents. This compromises confidentiality, integrity, and availability of the affected system's data. The vulnerability can be exploited remotely without any user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and parameterized queries to sanitize the id parameter in translate_text.php to prevent SQL injection.