CWE-1021

Improper Restriction of Rendered UI Layers or Frames

Parent: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

401 vulnerabilities with CWE-1021

CVE-2025-49191 MEDIUM

Sick Field Analytics - Code Execution via iFrame Widget URLs

CVSS 4.8

CVE-2025-49139 MEDIUM

HAX CMS PHP < 11.0.0 - Website Block Credential Phishing

CVSS 5.3

CVE-2025-5267 MEDIUM

Firefox < 139 - Thunderbird < 128.11 - Info Disclosure

CVSS 5.4

CVE-2025-43854 MEDIUM

DIFY < 0.6.8 - Clickjacking via Unrestricted UI Layer Rendering

CVSS 6.1

CVE-2025-32385 MEDIUM

EspoCRM < 9.0.5 - Unauthenticated Iframe Injection via Dashlet

CVSS 5.3

CVE-2025-0362 MEDIUM

GitLab CE/EE <17.8.7-17.10.4 - CSRF

CVSS 6.4

CVE-2025-25213 MEDIUM

Wi-Fi AP UNIT AC-WPS-11ac - Info Disclosure

CVSS 6.5

CVE-2025-31138 MEDIUM

tarteaucitron.js <1.20.1 - XSS

CVSS 5.5

CVE-2025-24310 MEDIUM

HMI ViewJet C-more - Info Disclosure

CVSS 4.3

CVE-2025-1923 MEDIUM

Google Chrome < 134.0.6998.35 - UI Spoofing via Malicious Extension Permission Prompts

CVSS 4.3

CVE-2025-1917 MEDIUM

Google Chrome <134.0.6998.35 - CSRF

CVSS 4.3

CVE-2025-1940 HIGH

Firefox < 136.0 - UI Spoofing via Select Option Overlay

CVSS 7.1

CVE-2025-24874 MEDIUM

SAP Commerce (Backoffice) - Info Disclosure

CVSS 6.8

CVE-2025-1019 MEDIUM

Firefox < 135.0 and Thunderbird 131.0-134.0 - UI Spoofing via Fullscreen Notification Z-Order Manipulation

CVSS 4.3

CVE-2025-1018 MEDIUM

Firefox < 135.0 - UI Spoofing via Premature Fullscreen Notification Hiding

CVSS 5.3

CVE-2024-13066 MEDIUM

LimonDesk s1.02.14-v1.02.17 - Clickjacking via iFrame Overlay

CVSS 4.3

CVE-2024-49796 MEDIUM

IBM ApplinX 11.1 - Clickjacking

CVSS 5.4

CVE-2024-6466 MEDIUM

NEC WebSAM DeploymentManager 6.0-6.80 - SSRF

CVSS 5.3

CVE-2024-57369 MEDIUM

typecho 1.2.1 - Clickjacking

CVSS 6.4

CVE-2024-56436 MEDIUM

HarmonyOS - Cross-Process Screen Stack Vulnerability in UIExtension Module

CVSS 5.5

CVE-2024-56435 MEDIUM

HarmonyOS - Cross-Process Screen Stack Vulnerability in UIExtension Module

CVSS 6.2

CVE-2024-55888 HIGH

Hush Line <0.3.5 - CSRF

CVSS 7.1

CVE-2024-54112 MEDIUM

HarmonyOS - Cross-Process Screen Stack Vulnerability in UIExtension Module

CVSS 5.5

CVE-2024-54110 MEDIUM

HarmonyOS - Cross-Process Screen Stack Vulnerability in UIExtension Module

CVSS 6.2

CVE-2024-53976 MEDIUM

Firefox for iOS < 133 - Info Disclosure

CVSS 5.4

Details

Vulnerabilities 401

Links