This vulnerability is a reflected XSS in the login_newpwd.php endpoint of ZenShare Suite v17.0, where the codice_azienda parameter is not properly sanitized, allowing injection of malicious JavaScript code. When a user accesses a crafted URL containing this parameter, the injected script executes in their browser context, potentially compromising user data confidentiality and integrity. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser session, potentially leading to theft of sensitive information or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on suspicious links involving the codice_azienda parameter. Implementing web application firewall (WAF) rules to detect and block reflected XSS attempts may provide temporary mitigation.