CVE-2026-30252: Interzen Zencrm

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Multiple reflected cross-site scripting (XSS) vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codice_azienda and red_url parameters.

Affected products

• Interzen Zencrm: version 17.0 only
• Interzen Zenhr: version 17.0 only
• Interzen Zenproject: version 17.0 only
• Interzen Zenpurchase: version 17.0 only

Published 2026-04-02. Last modified 2026-07-24.