A reflected cross‑site scripting flaw resides in the login_newpwd.php endpoint of ZenShare Suite 17.0. Injecting crafted JavaScript into the codice_azienda query parameter can cause a victim’s browser to execute arbitrary code while the site appears legitimate. The flaw is a client‑side code execution vulnerability identified as CWE‑79. Based on the nature of reflected XSS, an attacker could potentially hijack sessions, steal credentials, or alter the page presented to the user, though no direct server exposure is described.

Only ZenShare Suite 17.0 distributed by Interzen Consulting S.r.l. is mentioned as vulnerable. No other vendors, products, or version ranges appear in the data. Therefore the risk is confined to this single product and release.

The CVSS score of 6.1 signals a medium severity, and the EPSS score of under 1% indicates a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require a victim to click a malicious link or be exposed to a crafted URL, implying a remote web‑access attack vector. No privileged credentials or additional conditions are noted in the data, but this lack of stated constraints is an inference, not an explicit requirement.