Beghelli Sicuro24 SicuroWeb contains a template injection vulnerability that allows attackers to inject arbitrary AngularJS expressions by exploiting improper rendering of untrusted input in AngularJS template contexts. Attackers can inject malicious expressions that are compiled and executed by the AngularJS 1.5.2 runtime to achieve arbitrary JavaScript execution in operator browser sessions, with network‑adjacent attackers able to deliver payloads via MITM injection in plaintext HTTP deployments.

The vulnerability affects installations of Beghelli’s SicuroWeb (Sicuro24) software, particularly those that render untrusted user input within AngularJS 1.5.2 templates. All versions released prior to any vendor patch for CVE‑2026‑22191 are potentially vulnerable.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score of less than 1 % indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. Attackers exploiting this flaw can use AngularJS template injection by providing malicious input that is rendered unescaped in the application's template contexts. This injection can execute arbitrary JavaScript within the victim’s browser session, potentially exposing session cookies, credentials, or enabling phishing attacks. Due to the requirement of untrusted input rendering and the lack of privileged access, attackers can achieve compromise from unauthenticated or low‑privileged user actions, making the overall risk moderate for anyone exposing such templates over the network, especially in plain HTTP deployments.