CVE-2026-38579 Details
Description
Multiple reflected Cross-Site Scripting (XSS) vulnerabilities in damasac thaipalliative_lte through version 3.0 allow remote attackers to inject arbitrary web script or HTML via the idFormMain parameter (line 24), the id parameter (lines 25, 75), and the ptid_key parameter (lines 26, 42) in /substudy/ezform.php. User input is echoed into HTML attributes and JavaScript contexts without encoding.
A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Damasac Thaipalliative_LTE versions 1.0 through 3.0. The issue resides in the '/substudy/ezform.php' file, where user input from the 'idFormMain', 'id', and 'ptid_key' parameters is echoed into HTML attributes and JavaScript contexts without proper encoding. This lack of sanitization allows remote attackers to inject and execute arbitrary web scripts or HTML in the context of the user's browser.
Users are advised to encode all output from user-supplied values using 'htmlspecialchars()' with the 'ENT_QUOTES' flag before displaying them in HTML. For JavaScript contexts, 'json_encode()' should be used to ensure safe injection. Additionally, a Content Security Policy (CSP) header can help mitigate the effects of any unaddressed vulnerabilities.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 5, 2026CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/theemperorspath/advisories/blob/main/2026/CVE-2026-38579.md | CISA-ADP | AdvisoryExploitRemedy |
| https://github.com/damasac/thaipalliative_lte/blob/57b57630fb403eba524533062ef5244e9b7c4380/substudy/ezform.php#L14 | [email protected] | Source CodeVendor |
| https://github.com/theemperorspath/advisories/blob/main/2026/CVE-2026-38579.md | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| damasac thaipalliative_lte | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | New CVE Received | [email protected] |