CVE-2026-30252 Details
Description
Multiple reflected cross-site scripting (XSS) vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codice_azienda and red_url parameters.
A reflected cross-site scripting vulnerability has been identified in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite version 17.0. This vulnerability allows attackers to execute arbitrary JavaScript in the context of the user's browser. The issue arises from crafted URLs injected into the codice_azienda and red_url parameters.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/skit-cyber-security/ZenShare-Suite | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| interzen zencrm | 17.0 |
CPE
Remediation
| |
| interzen zenhr | 17.0 |
CPE
Remediation
| |
| interzen zenproject | 17.0 |
CPE
Remediation
| |
| interzen zenpurchase | 17.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | Initial Analysis | [email protected] |
| Apr 3, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2026 | New CVE Received | [email protected] |