These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A SQL Injection vulnerability was discovered in damasac thaipalliative_lte through version 3.0. This vulnerability allows remote attackers to execute arbitrary SQL commands via the idFormMain parameter to /substudy/ezform.php (line 14) and the id parameter (line 49). The parameters are concatenated directly into SQL queries without sanitization or parameterized statements.
CVE-2026-38579 is a MEDIUM severity vulnerability in damasac thaipalliative_lte through version 3.0. Multiple reflected Cross-Site Scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the idFormMain parameter, the id parameter, and the ptid_key parameter in /substudy/ezform.php. User input is echoed into HTML attributes and JavaScript contexts without encoding.