PT-2026-46963 · Damasac · Thaipalliative Lte

CVE-2026-38579 · Published 2026-06-05 · Updated 2026-06-05

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions damasac thaipalliative lte versions prior to 3.1

Description Multiple reflected Cross-Site Scripting (XSS) issues exist where user input is echoed into HTML attributes and JavaScript contexts without proper encoding. This allows remote attackers to inject arbitrary web script or HTML through the '/substudy/ezform.php' endpoint using the idFormMain, id, and ptid key parameters.

Recommendations Update damasac thaipalliative lte to a version later than 3.0. As a temporary workaround, restrict access to the '/substudy/ezform.php' endpoint or sanitize the idFormMain, id, and ptid key parameters to prevent script injection.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-38579

Affected Products

Thaipalliative Lte

References · 4

• 🔥 https://github.com/theemperorspath/advisories/blob/main/2026/CVE-2026-38579.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-38579 · Security Note
• https://github.com/damasac/thaipalliative_lte/blob/57b57630fb403eba524533062ef5244e9b7c4380/substudy/ezform.php#L14 · Note
• https://twitter.com/VulmonFeeds/status/2062953086864204087 · Twitter Post