CVE-2026-22191

· MEDIUMModified

← All CVEs

CVSS v3.1

5.2

CVSS v4.0

5.1

EPSS

0.36%

Published

Mar 13, 2026

Modified

Apr 22, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Beghelli Sicuro24 SicuroWeb contains a template injection vulnerability that allows attackers to inject arbitrary AngularJS expressions by exploiting improper rendering of untrusted input in AngularJS template contexts. Attackers can inject malicious expressions that are compiled and executed by the AngularJS 1.5.2 runtime to achieve arbitrary JavaScript execution in operator browser sessions, with network-adjacent attackers able to deliver payloads via MITM injection in plaintext HTTP deployments.

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-1336

Affected Products (1)

gvectors · wpdiscuz (up to 7.6.47)vulnerable

References (5)

https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-POC.py

https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22191-SicuroWeb-ATI-chain.txt

https://www.beghelli.it

https://www.boffsec-services.com/posts/sicuroweb-cve-2026-22191/

https://www.vulncheck.com/advisories/beghelli-sicuro24-sicuroweb-angularjs-template-injection

KEV Catalog EPSS Scores Vendors All CVEs