The damasac thaipalliative_lte web application contains a reflected cross‑site scripting vulnerability that is triggered when an attacker supplies specially crafted input via the idFormMain, id, or ptid_key parameters to the ezform.php script. User input is echoed directly into the page without HTML or JavaScript encoding, permitting arbitrary client‑side code execution within the victim’s browser context. This can be used to hijack sessions, steal cookies, or inject malicious content affecting confidentiality, integrity, and availability. The flaw is a classic instance of CWE‑79 reflected XSS.

The vulnerable product is damasac thaipalliative_lte, available on GitHub, and affected through version 3.0 or earlier. The issue resides in the /substudy/ezform.php file, where the idFormMain, id, and ptid_key parameters are used without proper sanitization. No other vendors or product versions are listed as affected.

The flaw can be exploited remotely by constructing URLs or form submissions that include malicious payloads in the idFormMain, id, or ptid_key fields; no authentication is required. With a CVSS score of 6.1 and an EPSS score of less than 1 %, the vulnerability is considered medium severity, and it is not currently listed in CISA’s KEV catalog. The likely attack vector is web‑based input reflection, making the vulnerability a moderate risk for any environment running an unpatched version of the application.