PT-2026-46963 · Undefined · Undefined

Published 2026-06-05 · Updated 2026-06-05 · CVE-2026-38579

NVD

Multiple reflected Cross-Site Scripting (XSS) vulnerabilities in damasac thaipalliative lte through version 3.0 allow remote attackers to inject arbitrary web script or HTML via the idFormMain parameter (line 24), the id parameter (lines 25, 75), and the ptid key parameter (lines 26, 42) in /substudy/ezform.php. User input is echoed into HTML attributes and JavaScript contexts without encoding.

Exploit

Related Identifiers

CVE-2026-38579

Affected Products

Undefined

References · 3

• 🔥 https://github.com/theemperorspath/advisories/blob/main/2026/CVE-2026-38579.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-38579 · Security Note
• https://github.com/damasac/thaipalliative_lte/blob/57b57630fb403eba524533062ef5244e9b7c4380/substudy/ezform.php#L14 · Note