What is the CVSS score of CVE-2026-30251?

CVE-2026-30251 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-30251

EUVD-2026-18548 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-02 mitre

GHSA-5x28-243x-9mx6

XSS PHP

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 02, 2026 - 21:01 euvd

EUVD-2026-18548

Analysis Generated

Apr 02, 2026 - 21:01 vuln.today

CVE Published

Apr 02, 2026 - 00:00 nvd

MEDIUM 6.1

DescriptionCVE.org

A reflected cross-site scripting (XSS) vulnerability in the login_newpwd.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codice_azienda parameter.

AnalysisAI

Reflected XSS in Interzen Consulting ZenShare Suite v17.0 login_newpwd.php endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in users' browsers by injecting malicious code into the codice_azienda parameter via a crafted URL. No public exploit code or active exploitation has been confirmed at the time of this analysis, though the vulnerability is straightforward to demonstrate and likely poses a practical risk to organizations using this product.

Technical ContextAI

The vulnerability exists in a PHP-based web application (ZenShare Suite) where user input from the codice_azienda URL parameter is reflected directly into the login password reset endpoint (login_newpwd.php) without proper sanitization or encoding. This is a classic reflected XSS vulnerability (CWE class related to improper neutralization of input during web page generation). The attack leverages the trust that users have in legitimate URLs from their organization; when a user clicks a malicious link crafted by an attacker, the JavaScript payload executes in the security context of the user's authenticated session with ZenShare Suite. The vulnerability resides in a password reset flow, making it particularly concerning as attackers could steal session tokens, credentials, or perform actions on behalf of legitimate users.

RemediationAI

Immediate mitigation requires upgrading to a patched version of ZenShare Suite beyond v17.0 if available from Interzen Consulting; consult the vendor's security advisory at https://vuldb.com/vuln/355009 or https://nvd.nist.gov/vuln/detail/CVE-2026-30251 for specific patched versions. As an interim workaround, implement strict input validation and output encoding on the codice_azienda parameter to reject or sanitize special characters and HTML metacharacters. Additionally, enforce Content Security Policy (CSP) headers to restrict script execution and apply Web Application Firewall (WAF) rules to detect and block payloads containing JavaScript in URL parameters. Conduct a security review of the login_newpwd.php endpoint and similar password reset flows to ensure all user inputs are properly HTML-encoded before being reflected in page responses.