CWE-1021
Improper Restriction of Rendered UI Layers or Frames
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
401 vulnerabilities with CWE-1021
CVE-2025-0421
MEDIUM
Shopside <05022025 - Info Disclosure
CVSS 4.7
CVE-2025-64387
MEDIUM
Circutor TCPRS1plus >=1.0.14 <1.0.14 - Clickjacking
CVE-2025-30191
MEDIUM
OX App Suite < 7.6.3-rev77, < 8.35.111, < 8.38.82, < 8.39.79, < 8.40.57 - Clickjacking via HTML Fragment Injection
CVSS 5.4
CVE-2025-28129
MEDIUM
Phpgurukul Hostel Mgt Sys 2.1 - CSRF
CVSS 5.4
CVE-2025-52658
LOW
HCL MyXalytics - Info Disclosure
CVSS 3.5
CVE-2025-59950
MEDIUM
FreshRSS < 1.27.0 - Clickjacking Bypass via Double Click Confirmation Dialog
CVSS 6.7
CVE-2025-57769
MEDIUM
FreshRSS < 1.27.0 - Cross-Site Scripting and Privilege Escalation via Iframe UI Obscuring
CVSS 6.1
CVE-2025-0546
MEDIUM
MevzuatTR < 12.02.2025 - Authenticated Clickjacking via iFrame Overlay
CVSS 4.7
CVE-2025-32350
HIGH
Android - Tapjacking/Overlay Attack via ControlsSettingsDialog
CVSS 7.8
CVE-2025-32349
HIGH
Android - Privilege Escalation via Tapjacking/Overlay Attack
CVSS 7.8
CVE-2025-41000
LOW
BoomCMS 9.1.4 - Cross-Frame Scripting
CVE-2025-22419
HIGH
Multiple Locations - Privilege Escalation
CVSS 7.3
CVE-2025-22417
HIGH
Android - Tapjacking/Overlay Attack via Transition.java finishTransition
CVSS 7.3
CVE-2025-1494
MEDIUM
IBM Cognos Command Center 10.2.4.1-10.2.5 - CSRF
CVSS 6.1
CVE-2025-9108
MEDIUM
Portabilis i-Diario - Clickjacking via Login Page
CVSS 4.3
CVE-2025-54527
MEDIUM
JetBrains YouTrack <2025.2.86935-2025.3.87344 - CSRF
CVSS 6.1
CVE-2025-54139
MEDIUM
HAX CMS NodeJS and PHP - Clickjacking UI Redressing
CVSS 4.3
CVE-2025-7903
MEDIUM
yangzongzhuan RuoYi <4.8.1 - Improper Restriction of Rendered UI La...
CVSS 4.3
CVE-2025-6983
MEDIUM
TP-Link Archer C1200 <= 1.1.5 - XSS
CVE-2025-27455
MEDIUM
meac300-fnade4_firmware < 0.16.0 - Clickjacking via Unrestricted UI Layer Embedding
CVSS 4.3
CVE-2025-53096
MEDIUM
lizardbyte/sunshine < 2025.628.4510 - Clickjacking via Web UI iframe Embedding
CVSS 5.4
CVE-2025-36027
MEDIUM
IBM Datacap 9.1.7-9.1.9 - Clickjacking
CVSS 5.4
CVE-2025-6557
MEDIUM
Google Chrome < 138.0.7204.49 - Remote Code Execution via DevTools UI Gesture
CVSS 5.4
CVE-2025-6434
MEDIUM
Firefox < 140.0 - Clickjacking via HTTPS-Only Exception Page
CVSS 4.3
CVE-2025-49192
MEDIUM
SICK Field Analytics - Clickjacking via Unrestricted UI Layer Embedding
CVSS 4.3
Details
Vulnerabilities
401