CVE-2026-30252
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Interzen Consulting S.r.l ZenShare Suite v17.0 contains multiple reflected XSS vulnerabilities in the login.php endpoint. An attacker can execute arbitrary JavaScript in the user's browser context via a crafted URL injected into the codice_azienda and red_url parameters.
Risk Assessment
The risk includes session theft, credential harvesting, and the possibility of phishing attacks on users.
Recommendation
Apply the vendor's patch immediately or implement input validation and sanitization for the codice_azienda and red_url parameters.
Original NVD description (English source)
Multiple reflected cross-site scripting (XSS) vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codice_azienda and red_url parameters.