VULNERABILITY INTELLIGENCE
CVE-2026-41469
CVSS score5.2 MEDIUM
EPSS probability0.20%
CISA KEVNot currently listed
Published2026-04-22
Last modified2026-10-26
CVSS vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
Beghelli Sicuro24 SicuroWeb does not enforce a Content Security Policy, allowing unrestricted loading of external JavaScript resources from attacker-controlled origins. When chained with the template injection and sandbox escape vulnerabilities present in the same application, the absence of CSP removes the browser-enforced restriction that would otherwise block external script execution, enabling attackers to load arbitrary remote payloads into operator browser sessions.
Weakness classification
- disclosure@vulncheck.com: CWE-693