CVE-2026-38579 describes multiple reflected XSS vulnerabilities in damasac thaipalliative_lte versions up to and including 3.0. The affected parameters are idFormMain, id, and ptid_key within the /substudy/ezform.php endpoint. These parameters are reflected in HTML attributes and JavaScript contexts without proper encoding or sanitization, enabling remote attackers to inject and execute arbitrary scripts. The CVSS 3.1 base score is 6.1, indicating a medium severity vulnerability with network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to information disclosure and modification of web content. There is no indication of impact on availability. The vulnerability requires user interaction (e.g., clicking a crafted link) and does not require authentication.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted links or inputs related to the affected parameters. Implementing input validation and proper output encoding on the affected parameters is recommended once a patch or guidance is provided.