What is the CVSS score of CVE-2026-38579?

CVE-2026-38579 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

thaipalliative_lte CVE-2026-38579

EUVD-2026-34845 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-05 mitre

GHSA-jcmf-mmvx-3hgc

PHP XSS N A

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 16:31 vuln.today

CVSS changed

Jun 09, 2026 - 14:22 NVD

6.1 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Multiple reflected Cross-Site Scripting (XSS) vulnerabilities in damasac thaipalliative_lte through version 3.0 allow remote attackers to inject arbitrary web script or HTML via the idFormMain parameter (line 24), the id parameter (lines 25, 75), and the ptid_key parameter (lines 26, 42) in /substudy/ezform.php. User input is echoed into HTML attributes and JavaScript contexts without encoding.

AnalysisAI

Multiple reflected Cross-Site Scripting vulnerabilities in damasac's thaipalliative_lte PHP application (through version 3.0) allow unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by crafting malicious URLs. The vulnerable file /substudy/ezform.php unsafely echoes four distinct user-controlled parameters - idFormMain, id (in two locations), and ptid_key - directly into HTML attributes and JavaScript contexts without output encoding. A proof-of-concept exists per SSVC data; however, EPSS is very low at 0.08% (23rd percentile) and exploitation is not confirmed by CISA KEV, suggesting limited widespread attacker interest at time of analysis.

Technical ContextAI

The affected product is a PHP web application (thaipalliative_lte) developed by GitHub user damasac, likely a Thai palliative care management system. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Reflected XSS): user-supplied GET or POST parameters are interpolated directly into rendered HTML and JavaScript without HTML entity encoding, JavaScript escaping, or Content Security Policy enforcement. The vulnerability spans multiple distinct injection points within a single file (/substudy/ezform.php): the idFormMain parameter at line 24, the id parameter at lines 25 and 75, and the ptid_key parameter at lines 26 and 42, indicating a systemic lack of output encoding throughout the file rather than an isolated oversight. The CPE data provided is generic (cpe:2.3:a:n/a:n/a), confirming this is a niche or unregistered product not tracked in the NVD CPE dictionary. Tagged as PHP and XSS by the reporting source.

RemediationAI

No vendor-released patch has been identified at time of analysis - no patched release version is referenced in any advisory or the GitHub repository. The primary remediation is to apply output encoding to all four vulnerable parameters in /substudy/ezform.php: idFormMain (line 24), id (lines 25 and 75), and ptid_key (lines 26 and 42). For HTML attribute contexts, use htmlspecialchars() with ENT_QUOTES and the correct character encoding; for JavaScript contexts, use JSON encoding or a dedicated JavaScript escaping function such as json_encode(). As a compensating control, deploying a Web Application Firewall (WAF) with XSS filtering rules can reduce exploitability but is not a substitute for source-level fixes. Implementing a Content Security Policy (CSP) header that restricts inline script execution would significantly limit the impact of any remaining XSS surface, though with the trade-off of potential compatibility issues for existing inline scripts. The researcher advisory is available at https://github.com/theemperorspath/advisories/blob/main/2026/CVE-2026-38579.md and the vulnerable code is visible at https://github.com/damasac/thaipalliative_lte/blob/57b57630fb403eba524533062ef5244e9b7c4380/substudy/ezform.php.