Guardian vulnerabilities
We track 19 vulnerabilities in Guardian products. 19 are rated high or critical, and none are known to be exploited. The most recent was published on July 1, 2026.
Latest Guardian vulnerabilities
- 9.8 Critical severity
language-system: Improper Neutralization of Special Elements used in an OS Command
Guardian language-system passes the id GET parameter directly into a PHP exec() call in text_to_subtitles.php (line 19) without sanitization: exec(\"php jobs/text_to_subtitles.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An
- 9.8 Critical severity
language-system: Improper Neutralization of Special Elements used in an OS Command
Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe.php (line 15) without sanitization: exec(\"php jobs/transcribe.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticat
- 9.8 Critical severity
language-system: Improper Neutralization of Special Elements used in an OS Command
Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe_amazon.php (line 15) without sanitization: exec(\"php jobs/transcribe_amazon.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An
- 9.8 Critical severity
language-system: Improper Neutralization of Special Elements used in an OS Command
Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate_text.php (line 18) without sanitization: exec(\"php jobs/translate_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unaut
- 9.8 Critical severity
language-system: Improper Neutralization of Special Elements used in an OS Command
Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech_text.php (line 18) without sanitization: exec(\"php jobs/speech_audio_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unaut
- 9.8 Critical severity
language-system: Improper Neutralization of Special Elements used in an OS Command
Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac.php (line 18) without sanitization: exec(\"php jobs/speech_audio_mac.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthen
- 9.8 Critical severity
language-system: Improper Neutralization of Special Elements used in an OS Command
Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac_text.php (line 18) without sanitization: exec(\"php jobs/speech_audio_mac_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. A
- 9.8 Critical severity
language-system: Improper Neutralization of Special Elements used in an OS Command
Guardian language-system passes the id GET parameter directly into a PHP exec() call in complex_start.php (line 14) without sanitization: exec(\"php jobs/complex.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticat
- 9.8 Critical severity
language-system: Improper Neutralization of Special Elements used in an OS Command
Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech.php (line 18) without sanitization: exec(\"php jobs/speech_audio.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated
- 9.8 Critical severity
language-system: Improper Neutralization of Special Elements used in an OS Command
Guardian language-system passes the id GET parameter directly into a PHP exec() call in text.php (line 15) without sanitization: exec(\"php jobs/text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote at
- 9.8 Critical severity
language-system: Improper Neutralization of Special Elements used in an OS Command
Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate.php (line 14) without sanitization: exec(\"php jobs/translate.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated
- 9.8 Critical severity
language-system: Improper Neutralization of Special Elements used in an OS Command
Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec(\"php jobs/subtitle_rendering.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauth
- 8.8 High severity
language-system: Improper Neutralization of Special Elements used in an SQL Command
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in translate_text.php (line 15): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL i
- 8.8 High severity
language-system: Improper Neutralization of Special Elements used in an SQL Command
Guardian language-system passes the name GET parameter directly into an unsanitized SQL query in designer.php (line 124): SELECT * FROM complex WHERE name='\".$_GET['name'].\"'. An authenticated attacker can perform error-based SQL injection to extract databas
- 8.8 High severity
language-system: Improper Neutralization of Special Elements used in an SQL Command
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php (line 16): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL inject
- 8.8 High severity
language-system: Improper Neutralization of Special Elements used in an SQL Command
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info_get.php (line 16): SELECT * FROM jobs where input1 = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract databas
- 8.8 High severity
language-system: Improper Neutralization of Special Elements used in an SQL Command
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in text_file.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perf
- 8.8 High severity
language-system: Improper Neutralization of Special Elements used in an SQL Command
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform
- 9.8 Critical severity
language-system: Improper Neutralization of Special Elements used in an SQL Command
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info.php (line 16): SELECT * FROM jobs where id = '\".$_GET['id'].\"'. No authentication is required. An unauthenticated attacker can perform error-based SQL inj