The vulnerability is the lack of a Content Security Policy in Beghelli Sicuro24 SicuroWeb, which allows users to load arbitrary JavaScript from any origin. When combined with the known template injection and sandbox escape flaws, this deficiency removes the browser‑enforced restriction that would otherwise block such external scripts, permitting attackers to inject and execute remote code in operator browser sessions. The flaw is an instance of improper security configuration (CWE‑693).

Beghelli SicuroWeb (Sicuro24) is the affected product. All deployed versions prior to the patch that implements a Content Security Policy are vulnerable. No specific version numbers are listed in the advisory.

The CVSS score of 5.1 indicates a moderate impact. The EPSS score is < 1% and the issue is not listed in the CISA KEV catalog. The likely attack vector is client‑side: an attacker who can influence the content displayed to an operator can embed a malicious script, which will then run with the operator’s browser privileges. Chaining with the existing template injection and sandbox escape vulnerabilities can further elevate the risk, enabling full remote code execution. Because the browser restrictions (CSP) are absent, the exploitation path remains feasible as long as an attacker can deliver malicious content to an operator session.