https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 12:58:34 +0000 https://cve.radiocsirt.org/vuln/cve-2026-34106 <p><strong>Affected:</strong> guardian language-system</p> <p>Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec(\&#34;php jobs/subtitle_rendering.php \&#34;.$login_session.\&#34; \&#34;.$_GET[&#39;id&#39;].\&#34; ...\&#34;). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to the id parameter to execute arbitrary OS commands on the server.</p> <p><strong>Affected:</strong> guardian language-system</p> <p>Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec(\&#34;php jobs/subtitle_rendering.php \&#34;.$login_session.\&#34; \&#34;.$_GET[&#39;id&#39;].\&#34; ...\&#34;). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to the id parameter to execute arbitrary OS commands on the server.</p> https://cve.radiocsirt.org/vuln/cve-2026-34106