CWE-1021: Clickjacking
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
Also known as Improper Restriction of Rendered UI Layers or Frames, UI Redress Attack, Tapjacking.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- ibm app connect enterprise IBM App Connect Enterprise is vulnerable to a clickjacking attack 2.5 Low
- go-vikunja vikunja Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color 5.1 Medium
- jetbrains youtrack In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via... 3.5 Low
- hcl aion HCL AION is affected by multiple security vulnerabilities. 3.1 Low
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in... 5.3 Medium
- opentext directory services (otds) A vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows... 5.3 Medium
- ibm db2 genius hub Multiple vulnerabilities that affects IBM Db2 Genius Hub 4.6 Medium
- am system alo suite Clickjacking vulnerability in the Alosuite web application. 5.1 Medium
- nocodb NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers 5.3 Medium
- microsoft edge (chromium-based), edge chromium +1 more Microsoft Edge (Chromium-based) Spoofing Vulnerability 4.3 Medium
- hcl software bigfix aex HCL BigFix AEX is affected by multiple security vulnerabilities. 6.4 Medium
- boneio Clickjacking in boneIO 6.9 Medium
- storybookjs storybook Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites 8.6 High
- google chrome Improper input validation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote... 8.8 High
- gitea Gitea Jupyter notebook UI redress through CSS class injection 3.5 Low
- open-webui Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview 8.4 High
- shenzhen hcc technology mpos m6 plus Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer 5.1 Medium
- google chrome Clickjacking in Messages in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote... 5.4 Medium
- google chrome Clickjacking in EVP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging... 5.4 Medium
- google chrome Clickjacking in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote... 5.4 Medium
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 more Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an... 5.4 Medium
- fortinet fortipam chrome extension A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome... 9.1 Critical
- apple ipados, macos, ios and ipados +1 more +3 more A memory corruption issue was addressed with improved input validation. This issue is fixed in... 7.8 High
- apple macos This issue was addressed with improved state management. This issue is fixed in macOS Golden Gate... 5.5 Medium
- openwebui open webui, open-webui +1 more Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin 8.7 High
- google chrome Clickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had... 4.2 Medium
- google chrome Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker... 5.4 Medium
- google chrome Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36... 4.0 Medium
- mozilla firefox, thunderbird +1 more Clickjacking issue in the DOM: Events component 6.1 Medium
- google android In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a... 7.3 High
- ebyte na111-m firmware Ebyte NA111-M Improper Restriction of Rendered UI Layers or Frames 5.3 Medium
-
geolensPyPI GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4) No score - the browser company of new york arcsearch Address bar spoofing risk in affected iOS versions of Arc Search 7.4 High
- mozilla firefox, firefox mobile +1 more Clickjacking issue in the Downloads component in Firefox for Android 6.5 Medium
- mozilla firefox, thunderbird +1 more Clickjacking issue in the Widget component 8.1 High
- mozilla firefox, thunderbird +1 more Information disclosure in the WebRTC component 7.5 High
- mozilla firefox, firefox mobile +1 more Clickjacking issue in Firefox for Android 6.5 Medium
- sap se data services management console Security Misconfiguration in SAP Data Services Management Console 3.7 Low
- electron Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path 7.2 High
- electron Electron: Cross-origin iframe can position native autofill popup 3.1 Low
- openwebui open webui, open-webui +1 more Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin 8.2 High
- oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware ... 7.5 High
- mozilla firefox Clickjacking issue in the WebExtensions component in Firefox for Android 6.5 Medium
- absolute secure access Frameable content vulnerability in the Secure Access server login page 6.1 Medium
- microsoft bing search, bing search for ios +1 more Microsoft Bing App for IOS Spoofing Vulnerability 8.1 High
- jetbrains youtrack In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible 3.5 Low
- No product listed ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative... 5.4 Medium
- google chrome Inappropriate implementation in Extensions in Google Chrome prior to 150.0.7871.47 allowed a... 5.4 Medium
- google chrome Inappropriate implementation in DarkMode in Google Chrome prior to 150.0.7871.47 allowed a remote... 4.3 Medium
- jupyter server, jupyter-server jupyter server, red hat migration toolkit for applications 8.2 +2 more +4 more Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP 9.3 Critical
- Show olderLoading…