CVE-2026-30251
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Interzen Consulting S.r.l ZenShare Suite v17.0 contains a reflected XSS vulnerability in the login_newpwd.php endpoint. An attacker can execute arbitrary JavaScript in the user's browser context via a crafted URL injected into the codice_azienda parameter.
Risk Assessment
The risk includes session theft, credential harvesting, and the possibility of phishing attacks on users.
Recommendation
Apply the vendor's patch immediately or implement input validation and sanitization for the codice_azienda parameter.
Original NVD description (English source)
A reflected cross-site scripting (XSS) vulnerability in the login_newpwd.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codice_azienda parameter.