Description

Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing known sandbox escape primitives. When combined with template injection present in the same application, these primitives allow attackers to escape the AngularJS sandbox and achieve arbitrary JavaScript execution in operator browser sessions, enabling session hijacking, DOM manipulation, and persistent browser compromise. Network-adjacent attackers can deliver the complete injection and escape chain via MITM in plaintext HTTP deployments without active user interaction.

INFO

Published Date :

2026-04-22T18:04:38.557Z

Last Modified :

2026-04-22T19:05:22.738Z

Source :

VulnCheck
AFFECTED PRODUCTS

The following products are affected by CVE-2026-41468 vulnerability.

Vendors Products
Beghelli
  • Sicuroweb (sicuro24)
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-41468.

URL Resource
https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-POC.py cve-icon cve-icon
https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-SicuroWeb-ATI-chain.txt cve-icon cve-icon
https://www.beghelli.it cve-icon cve-icon
https://www.boffsec-services.com/posts/sicuroweb-cve-2026-22191/ cve-icon cve-icon
https://www.vulncheck.com/advisories/beghelli-sicuro24-sicuroweb-angularjs-sandbox-escape-via-template-injection cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact