Guardian language‑system contains an SQL injection flaw in translate_text.php. The GET parameter id is concatenated directly into a SELECT statement without any sanitization, allowing an attacker to inject arbitrary SQL and trigger error-based data extraction from the database. The CVE description does not mention code execution or denial of service, so these outcomes are not supported by the current information and are inferred as not applicable.

The vulnerability resides in the Guardian language‑system web translation component, specifically within translate_text.php. The affected product is guardian:language-system. No specific software version is listed; therefore, the issue may exist in any deployed instance of the component accessed via the translate_text.php endpoint.

The CVSS score of 8.7 indicates high severity, while the EPSS score of < 1% suggests a low probability of exploitation at present. The attack vector is inferred to be remote, enabling an authenticated user to craft an id parameter that induces error‑based SQL injection. The vulnerability is not listed in CISA’s KEV catalogue, meaning there are no known active exploits, but the confidentiality impact warrants timely remediation.