CWE-1021: Improper Restriction of Rendered UI Layers or Frames, page 2
Filter
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
What the weakness is: CWE-1021 at MITRE. OWASP Top 10: A06:2025 Insecure Design
Related attack patterns (CAPEC): 7
- CAPEC-103 Clickjacking Likelihood: Medium · Severity: High
- CAPEC-181 Flash File Overlay Severity: Medium
- CAPEC-222 iFrame Overlay Likelihood: Medium · Severity: High
- CAPEC-504 Task Impersonation Likelihood: Medium · Severity: High
- CAPEC-506 Tapjacking Likelihood: Low · Severity: Low
- CAPEC-587 Cross Frame Scripting (XFS) Severity: High
- CAPEC-654 Credential Prompt Impersonation Likelihood: Medium · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-1021, as MITRE names them. Credits.
Ask an AI about CWE-1021
Show the prompt
Explain CWE-1021: Improper Restriction of Rendered UI Layers or Frames and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1021.html and https://cve.bz/cve/cwe/1021?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.8CVE-2026-0036EPSS 0.07%
In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not n…
- 4.0CVE-2026-21785EPSS 0.1%
A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load u…
- 2.9CVE-2026-9396EPSS 0.3%
A security flaw has been discovered in Besen BS20 EV Charging Station up to 20260426. Affected by this vulnerability is an unknown functionality of the component Firmware Version Check. The manipulation results in improper restriction of r…
- 7.3CVE-2026-37470EPSS 0.3%
An issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login page endpoint and HTTP response security headers components
- 6.1CVE-2026-42502EPSS 0.2%
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- 6.1CVE-2026-27136EPSS 0.2%
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- 6.1CVE-2026-25681EPSS 0.2%
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- 2.3CVE-2025-62316EPSS 0.1%
HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured. Absence of these headers may reduce the effectiveness of browser-based security controls and could expose the applica…
- 4.3CVE-2026-28971EPSS 0.3%
The issue was addressed with improved UI handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. A malicious iframe may use another website’s download settings.
- 3.1CVE-2026-8022EPSS 0.2%
Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted MHTML page. (Chromium security severity:…
- 3.5CVE-2026-3254EPSS 0.2%
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to load unauthorized content into another user's browser due to improper…
- 6.5CVE-2026-2378EPSS 0.2%
ArcSearch for Android versions prior to 1.12.7 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content.
- 3.7CVE-2025-62328EPSS 0.3%
HCL Nomad server on Domino did not configure the frame-ancestors directive in the Content-Security-Policy header by default which could allow an attacker to obtain sensitive information via unspecified vectors.
- 8.6CVE-2026-0007EPSS 0.1%
In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. Us…
- 5.3CVE-2025-58405EPSS 0.2%
The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting protections were detected. As a result, an attacker can embed the application insi…
- 5.1CVE-2026-27511EPSS 0.2%
Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a clickjacking vulnerability in the web-based administrative interface. The interface does not set the X-Frame-Options header, allowing attacker-controlled sites to emb…
- 5.3CVE-2026-26000EPSS 0.3%
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it's possible using comments to inject CSS that would transform the full wiki in a link area le…
- 4.6CVE-2026-20645EPSS 0.2%
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An attacker with physical access to a locked device may be able to view sensi…
- 6.1CVE-2026-24839EPSS 0.2%
Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, the Dokploy web interface is vulnerable to Clickjacking attacks due to missing frame-busting headers. This allows attackers to embed Dokploy pages …
- 4.3CVE-2026-23731EPSS 0.3%
WeGIA is a web manager for charitable institutions. Prior to 3.6.2, The web application is vulnerable to clickjacking attacks. The WeGIA application does not send any defensive HTTP headers related to framing protection. In particular, X-F…
- 7.4CVE-2025-15032EPSS 0.3%
Missing about:blank indicator in custom-sized new windows in Dia before 1.9.0 on macOS could allow an attacker to spoof a trusted domain in the window title and mislead users about the current site.
- 5.1CVE-2025-52987EPSS 0.3%
A clickjacking vulnerability exists in the web portal of Juniper Networks Paragon Automation (Pathfinder, Planner, Insights) due to the application's failure to set appropriate X-Frame-Options and X-Content-Type HTTP headers. This vulnerab…
- 8.2CVE-2026-22918EPSS 0.3%
An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously crafted web pages, leading to the extraction of sensitive data.
- 4.3CVE-2025-65922EPSS 0.2%
PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes. While this does not lead to unintended modification of projects or tasks, it exposes users to Phishing at…
- 7.5CVE-2025-14812EPSS 0.3%
ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-triggered URI-scheme navigation, increasing spoofing risk.
- 7.4CVE-2025-14809EPSS 0.2%
ArcSearch for Android versions prior to 1.12.6 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content.
- 6.1CVE-2025-59849EPSS 0.2%
Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicious code in web pages.
- 5.1CVE-2025-59479EPSS 0.2%
CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper restriction of rendered UI layers or frames. If a user clicks on content on a malicious web page while logged into the product, unintended operations may be performed on th…
- 4.3CVE-2025-14373EPSS 0.3%
Inappropriate implementation in Toolbar in Google Chrome on Android prior to 143.0.7499.110 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)
- 7.3CVE-2025-48639EPSS 0.1%
In DefaultTransitionHandler.java, there is a possible way to unknowingly grant permissions to an app due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User …
- 7.8CVE-2025-48597EPSS 0.08%
In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interactio…
- 4.6CVE-2025-63522EPSS 0.2%
Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management function
- 5.4CVE-2025-36149EPSS 0.2%
IBM Concert Software 1.0.0 through 2.0.0 could allow a remote attacker to hijack the clicking action of the victim.
- 7.4CVE-2025-13132EPSS 0.3%
This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site …
- 4.7CVE-2025-0421EPSS 0.2%
Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay. This issue affects Shopside: through 05022025.
- 5.1CVE-2025-64387EPSS 0.4%
The web application is vulnerable to a so-called ‘clickjacking’ attack. In this type of attack, the vulnerable page is inserted into a page controlled by the attacker in order to deceive the victim. This deception can range from making the…
- 5.4CVE-2025-30191EPSS 0.2%
Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information to a third party which would enable further threats. Attribute values containing …
- 5.4CVE-2025-28129EPSS 0.2%
Phpgurukul Hostel Management System 2.1 is vulnerable to clickjacking.
- 4.8CVE-2025-52658EPSS 0.2%
HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be exploited.
- 5.4CVE-2025-59950EPSS 0.3%
FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.3 and below, due to a bypass of double clickjacking protection (confirmation dialog), it is possible to trick the admin into clicking the Promote button in another user's m…
- 5.3CVE-2025-57769EPSS 0.3%
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements i…
- 4.7CVE-2025-0546EPSS 0.2%
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Restriction of Rendered UI Layers or Frames vulnerability in Mevzuattr Software MevzuatTR allows Phishing, iFrame Overlay, Clickjacking, …
- 7.8CVE-2025-32350EPSS 0.09%
In maybeShowDialog of ControlsSettingsDialogManager.kt, there is a possible overlay of the ControlsSettingsDialog due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges …
- 7.8CVE-2025-32349EPSS 0.10%
In multiple locations, there is a possible privilege escalation due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploit…
- 4.3CVE-2024-13066EPSS 0.2%
Improper Restriction of Rendered UI Layers or Frames vulnerability in Akinsoft LimonDesk allows iFrame Overlay, CAPEC - 103 - Clickjacking. This issue affects LimonDesk: from s1.02.14 before v1.02.17.
- 2.1CVE-2025-41000EPSS 0.3%
Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits specific browser bugs to spy on users via JavaScript. This type of attack is based on social engineering and depends e…
- 7.3CVE-2025-22419EPSS 0.08%
In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. U…
- 7.3CVE-2025-22417EPSS 0.08%
In finishTransition of Transition.java, there is a possible way to bypass touch filtering restrictions due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. Use…
- 6.1CVE-2025-1494EPSS 0.3%
IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the…
- 2.1CVE-2025-9108EPSS 0.3%
Affected is an unknown function of the component Login Page. The manipulation leads to improper restriction of rendered ui layers. It is possible to launch the attack remotely.