https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T15:48:53.728524+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-336723 EUVD-2026-336723 2026-10-09T15:48:53.773834+00:00 EUVD-2026-336723 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34107 fkie_cve-2026-34107 2026-10-09T15:48:53.773871+00:00

Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate.php (line 14) without sanitization: exec(\"php jobs/translate.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

 https://cve.radiocsirt.org/vuln/ghsa-qp96-wjq3-2qcj GHSA-qp96-wjq3-2qcj 2026-10-09T15:48:53.773908+00:00

Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate.php (line 14) without sanitization: exec(\"php jobs/translate.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.