Guardian language-system contains an unauthenticated SQL injection flaw in job_info.php. The id GET parameter is concatenated directly into an unsanitized query: SELECT * FROM jobs where id = ?. This allows an attacker to extract the database version, current user, schema names, and table contents, leading to a severe confidentiality breach. This aligns with CWE-89.

The vulnerable component is the Guardian language-system, specifically the job_info.php endpoint. No version information is listed, so any installation that includes this file and exposes it to the public web is potentially affected. Administrators should determine whether the file is reachable without authentication and assess the environment accordingly.

The CVSS score of 9.3 indicates a critical severity for confidentiality, though the CVE does not mention availability impact. The EPSS score of < 1% reflects a very low current exploitation likelihood, yet the vulnerability remains exploitable without credentials. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a crafted HTTP request to job_info.php with a malicious id parameter. If exploited, the attacker can read sensitive database contents, compromising confidentiality.