A reflected cross‑site scripting vulnerability exists in the login_newpwd.php endpoint of ZenShare Suite. By including a malicious value in the codice_azienda parameter, an attacker can inject and execute arbitrary JavaScript in the victim’s browser. This allows the attacker to steal session cookies, perform phishing or other client‑side abuses within the context of the logged‑in user.

This flaw affects Interzen Consulting S.r.l ZenShare Suite version 17.0. No other versions are listed as vulnerable in the current advisory.

The vulnerability carries a CVSS score of 6.1, indicating moderate severity, and an EPSS score of less than 1 %, suggesting low exploit probability. It is not recorded in the CISA KEV catalog. Attackers can exploit the flaw by simply visiting a crafted URL; authentication is not required. Given these metrics, the overall risk remains moderate, but the availability of an exploit vector warrants immediate attention.