Federico Mirra

**Name of the Vulnerable Software and Affected Versions** ZenShare Suite version 17.0 **Description** A reflected cross-site scripting (XSS) issue exists in the 'login newpwd.php' endpoint. This allows attackers to execute arbitrary Javascript in the user's browser by injecting a crafted URL into the `codice azienda` parameter. **Recommendations** Update ZenShare Suite to a version newer than 17.0. As a temporary mitigation, restrict access to the 'login newpwd.php' endpoint or avoid using the `codice azienda` parameter until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** ZenShare Suite version 17.0 **Description** Reflected cross-site scripting (XSS) occurs in the 'login.php' endpoint. This allows attackers to execute arbitrary Javascript within the user's browser by injecting a crafted URL into the `codice azienda` and `red url` parameters. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.