Description
Beghelli Sicuro24 SicuroWeb does not enforce a Content Security Policy, allowing unrestricted loading of external JavaScript resources from attacker-controlled origins. When chained with the template injection and sandbox escape vulnerabilities present in the same application, the absence of CSP removes the browser-enforced restriction that would otherwise block external script execution, enabling attackers to load arbitrary remote payloads into operator browser sessions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Beghelli SicuroWeb (Sicuro24)
Default version status: unknown
0affected
References
- https://www.boffsec-services.com/posts/sicuroweb-cve-2026-22191/ ↗
- https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-POC.py ↗
- https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-SicuroWeb-ATI-chain.txt ↗
- https://www.beghelli.it ↗
- https://www.vulncheck.com/advisories/beghelli-sicuro24-sicuroweb-missing-content-security-policy ↗