Interzen · Zenshare Suite · CVE-2026-30251
**Name of the Vulnerable Software and Affected Versions**
ZenShare Suite version 17.0
**Description**
A reflected cross-site scripting (XSS) issue exists in the 'login newpwd.php' endpoint. This allows attackers to execute arbitrary Javascript in the user's browser by injecting a crafted URL into the `codice azienda` parameter.
**Recommendations**
Update ZenShare Suite to a version newer than 17.0.
As a temporary mitigation, restrict access to the 'login newpwd.php' endpoint or avoid using the `codice azienda` parameter until a patch is applied.