CVE-2026-38581

Name of the Vulnerable Software and Affected Versions damasac thaipalliative lte versions prior to 3.1

Description Remote attackers can execute arbitrary SQL commands due to improper sanitization and a lack of parameterized statements. The issue occurs when parameters are concatenated directly into SQL queries. The affected endpoint is '/substudy/ezform.php', specifically involving the idFormMain and id parameters.

Recommendations Update to a version later than 3.0. As a temporary workaround, restrict access to the '/substudy/ezform.php' endpoint or avoid using the idFormMain and id parameters until a patch is applied.