This vulnerability consists of multiple reflected XSS issues in the login.php endpoint of ZenShare Suite v17.0 by Interzen Consulting S.r.l. Specifically, the codice_azienda and red_url URL parameters do not properly sanitize user input, allowing attackers to inject arbitrary JavaScript code. When a user accesses a crafted URL containing these malicious parameters, the injected script executes in the user's browser context, potentially leading to information disclosure or session manipulation. The CVSS 3.1 vector indicates the attack requires no privileges, has low attack complexity, user interaction is required, and the impact affects confidentiality and integrity with no impact on availability.

Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser, which can lead to theft of sensitive information such as session tokens or user data, and manipulation of the user interface. However, the vulnerability does not impact system availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on URLs targeting the login.php endpoint with codice_azienda and red_url parameters. Implementing web application firewall (WAF) rules to detect and block suspicious input patterns may provide temporary mitigation.