Vulnerability · Published Mar 13, 2026 · Assigned by VulnCheck
CVE-2026-22191Beghelli Sicuro24 SicuroWeb AngularJS Template Injection
Medium 5.2
In plain English
A medium-severity security flaw in SicuroWeb (Sicuro24) from Beghelli. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Official description
Beghelli Sicuro24 SicuroWeb contains a template injection vulnerability that allows attackers to inject arbitrary AngularJS expressions by exploiting improper rendering of untrusted input in AngularJS template contexts. Attackers can inject malicious expressions that are compiled and executed by the AngularJS 1.5.2 runtime to achieve arbitrary JavaScript execution in operator browser sessions, with network-adjacent attackers able to deliver payloads via MITM injection in plaintext HTTP deployments.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Beghelli | SicuroWeb (Sicuro24) | 0 |
Weakness: CWE-1336 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://www.boffsec-services.com/posts/sicuroweb-cve-2026-22191/ technical-description, exploit
- https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-POC.py exploit
- https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-SicuroWeb-ATI-chain.txt technical-description
- https://www.beghelli.it product
- https://www.vulncheck.com/advisories/beghelli-sicuro24-sicuroweb-angularjs-template-injection third-party-advisory