CVE-2026-38581

The damasac thaipalliative_lte software (version 3.0 and earlier) is vulnerable to an SQL Injection flaw. The issue stems from the lack of sanitization or the use of parameterized statements when processing the idFormMain parameter in /substudy/ezform.php (line 14) and the id parameter (line 49)....

CVE-2026-38579

Multiple reflected Cross-Site Scripting XSS vulnerabilities in damasac thaipalliativelte through version 3.0 allow remote attackers to inject arbitrary web script or HTML via the idFormMain parameter line 24, the id parameter lines 25, 75, and the ptidkey parameter lines 26, 42 in...