CVE-2026-38581

CVE-2026-38581 affects damasac thaipalliative_lte up to version 3.0. The flaw is an SQL Injection in /substudy/ezform.php (idFormMain, id parameters) where user input is concatenated into SQL without sanitization or parameterization. This enables remote attackers to execute arbitrary SQL commands...

EUVD-2026-36241

SQL Injection vulnerability in damasac thaipalliativelte through version 3.0 allows remote attackers to execute arbitrary SQL commands via the idFormMain parameter to /substudy/ezform.php line 14 and the id parameter line 49. The parameters are concatenated directly into SQL queries without...

CVE-2026-38581

SQL Injection vulnerability in damasac thaipalliativelte through version 3.0 allows remote attackers to execute arbitrary SQL commands via the idFormMain parameter to /substudy/ezform.php line 14 and the id parameter line 49. The parameters are concatenated directly into SQL queries without...

CVE-2026-38579

Multiple reflected Cross-Site Scripting XSS vulnerabilities in damasac thaipalliativelte through version 3.0 allow remote attackers to inject arbitrary web script or HTML via the idFormMain parameter line 24, the id parameter lines 25, 75, and the ptidkey parameter lines 26, 42 in...

CVE-2026-38579

Multiple reflected Cross-Site Scripting XSS vulnerabilities in damasac thaipalliativelte through version 3.0 allow remote attackers to inject arbitrary web script or HTML via the idFormMain parameter line 24, the id parameter lines 25, 75, and the ptidkey parameter lines 26, 42 in...

CVE-2026-38579

CVE-2026-38579 affects damasac/thaipalliative_lte (up to version 3.0). The issue is multiple reflected XSS vulnerabilities in /substudy/ezform.php, where user input parameters idFormMain, id, and ptid_key are echoed into HTML attributes and JavaScript contexts without encoding. Public records sum...