Executive brief
ZenShare Suite, a business process and document management platform, is vulnerable to a security flaw in its password recovery page. An attacker could trick a user into clicking a malicious link, allowing the attacker to run unauthorized scripts in the user's web browser. This could lead to the theft of login session information or the performance of unauthorized actions on behalf of the user.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Interzen ZenShare Suite v17.0 within the 'login_newpwd.php' component. The vulnerability is caused by improper neutralization of user-supplied input in the 'codice_azienda' GET parameter. An unauthenticated remote attacker can exploit this by inducing a user to visit a specially crafted URL. Successful exploitation allows the execution of arbitrary JavaScript in the victim's browser session, potentially leading to session hijacking or unauthorized data access. The vulnerability is tracked as CVE-2026-30251.
Affected products
- Interzen Consulting S.r.l ZenShare Suite 17.0
Timeline
- 2026-04-02: disclosed: Initial disclosure via MITRE and NVD.
- 2026-04-02: advisory: Vendor advisory published on GitHub.