CVE-2026-30252

Published: Apr 2, 2026Modified: Jul 24, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Multiple reflected cross-site scripting (XSS) vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codice_azienda and red_url parameters.

Affected (4)

Products: Interzen: Zencrm, Zenhr, Zenproject, Zenpurchase

4 products

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Interzen Zencrm	Version 17.0
Interzen Zenhr	Version 17.0
Interzen Zenproject	Version 17.0
Interzen Zenpurchase	Version 17.0

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

https://github.com/skit-cyber-security/ZenShare-Suite

Source: cve@mitre.org

Vendor Advisory

Timeline

No history available yet.