CVE-2025-0421
iFrame Injection in Mikrogrup's Shopside
Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay.
This issue affects Shopside: through 05022025.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
iFrame Injection in Mikrogrup's Shopside
Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay.
This issue affects Shopside: through 05022025.
- Record
CVE-2025-0421- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-1021
- Updated
- 2026-11-02
EUVDEUVD-2025-198157
Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay.
This issue affects Shopside: through 05022025.
- Record
EUVD-2025-198157- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hfj2-6g68-rgrj
Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software...
Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay.This issue affects Shopside: through 05022025.
- Record
GHSA-hfj2-6g68-rgrj- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-1021
- Updated
- 2026-11-02
NVD
Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay.
This issue affects Shopside: through 05022025.
- Record
CVE-2025-0421- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-1021
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-0421 is a medium vulnerability (CVSS 4.7) in Shopside Software Technologies Inc. Shopside, published November 19, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. No source names a fixed version.