CVE-2026-34098: Guardian Language-System XSS via id Parameter in media.php
Published Jul 1, 2026
·Updated
Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action attributes in media.php (lines 119, 129). An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session.
Affected Software
1 affected component
Guardian Language-System
Event History
Jul 1, 2026
CVE Published
via MITRE·04:04 PM
Data Sourced
via MITRE·04:04 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-34098?
The severity of CVE-2026-34098 is categorized as medium with a score of 4.6.
2
How do I fix CVE-2026-34098?
To fix CVE-2026-34098, ensure that the id parameter is properly sanitized to prevent the injection of script tags.
3
What type of vulnerability is CVE-2026-34098?
CVE-2026-34098 is classified as a Cross-Site Scripting (XSS) vulnerability.
4
Who can exploit CVE-2026-34098?
An authenticated attacker can exploit CVE-2026-34098 by crafting a malicious URL.
5
What impact does CVE-2026-34098 have on users?
CVE-2026-34098 allows an attacker to inject scripts that execute in the victim's browser session, potentially compromising user data.