Medium severity6.1NVD Advisory· Published Apr 2, 2026· Updated Apr 10, 2026

CVE-2026-30252

Description

Multiple reflected cross-site scripting (XSS) vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codice_azienda and red_url parameters.

Affected products

Interzen/Zencrm
cpe:2.3:a:interzen:zencrm:17.0:*:*:*:*:*:*:*
Interzen/Zenhr
cpe:2.3:a:interzen:zenhr:17.0:*:*:*:*:*:*:*
Interzen/Zenproject
cpe:2.3:a:interzen:zenproject:17.0:*:*:*:*:*:*:*
Interzen/Zenpurchase
cpe:2.3:a:interzen:zenpurchase:17.0:*:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000