FKIE_CVE-2026-30252

Vulnerability from fkie_nvd - Published: 2026-04-02 21:16 - Updated: 2026-07-24 21:10
Severity
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Multiple reflected cross-site scripting (XSS) vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codice_azienda and red_url parameters.
References
cve@mitre.orghttps://github.com/skit-cyber-security/ZenShare-SuiteVendor Advisory
Impacted products
Vendor Product Version
interzen zencrm 17.0
interzen zenhr 17.0
interzen zenproject 17.0
interzen zenpurchase 17.0
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:interzen:zencrm:17.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "AF358C58-BDBB-49B1-A369-A68B23CCDF64",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:interzen:zenhr:17.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B7C5D87-0DD7-49D4-8449-C13960981A2E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:interzen:zenproject:17.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "151F4DBD-F656-435A-9352-9DE978766533",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:interzen:zenpurchase:17.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D976EEE6-1493-471B-B60B-AF06827B337C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple reflected cross-site scripting (XSS) vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user\u0027s browser via a crafted URL injected into the codice_azienda and red_url parameters."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de cross-site scripting (XSS) reflejadas en el endpoint login.php de Interzen Consulting S.r.l ZenShare Suite v17.0 permiten a los atacantes ejecutar Javascript arbitrario en el contexto del navegador del usuario a trav\u00e9s de una URL manipulada inyectada en los par\u00e1metros codice_azienda y red_url."
    }
  ],
  "id": "CVE-2026-30252",
  "lastModified": "2026-07-24T21:10:00.143",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-30252",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-03T14:40:08.376376Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-02T21:16:40.490",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/skit-cyber-security/ZenShare-Suite"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.