CWE-1021: Clickjacking
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
Also known as Improper Restriction of Rendered UI Layers or Frames, UI Redress Attack, Tapjacking.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- mevzuattr software mevzuattrXSS in Mevzuattr Software's MevzuatTR4.7 Medium
- akinsoft limondeskiFrame Injection in Akinsoft's LimonDesk4.3 Medium
- boomcmsCross-Frame Scripting (XFS) in BoomCMS2.1 Low
- google androidIn maybeShowDialog of ControlsSettingsDialogManager.kt, there is a possible overlay of the...7.8 High
- google androidIn multiple locations, there is a possible privilege escalation due to a tapjacking/overlay...7.8 High
- ibm cognos command centerIBM Cognos Command Center clickjacking6.1 Medium
- portabilis i-diarioPortabilis i-Diario Login Page ui layer5.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper...6.1 Medium
- psu haxcms-nodejs, haxcms-php, haxtheweb issues +2 moreHAX CMS' application pages are vulnerable to clickjacking4.3 Medium
- ruoyiyangzongzhuan RuoYi Image Source ui layer5.3 Medium
- tp-link system inc. archer c1200Clickjacking vulnerability on the management web application of TP-LINK Archer C12005.1 Medium
- endress meac300-fnade4 firmware, endress+hauser meac300-fnade4 +1 moreCVE-2025-274554.3 Medium
- lizardbyte sunshineSunshine clickjacking in the UI leads to unauthorized actions being performed5.4 Medium
- ibm datacap, datacap navigator +1 moreIBM Datacap clickjacking5.4 Medium
- google chromeInsufficient data validation in DevTools in Google Chrome on Windows prior to 138.0.7204.49...5.4 Medium
- mozilla firefox, thunderbird +1 moreHTTPS-Only exception screen lacked anti-clickjacking delay4.3 Medium
- sick field analytics, media server +1 moreClickjacking4.3 Medium
- sick field analyticsDashboards and iFrames can link malicious web content4.8 Medium
- psu haxcms-nodejs, haxtheweb issues, psu haxcms-php +2 more@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability5.3 Medium
- mozilla firefox, thunderbird +1 moreClickjacking vulnerability could have led to leaking saved payment card details5.4 Medium
- langgenius difyDIFY vulnerable to Clickjacking Attack2.3 Low
- espocrmEspoCRM allows unrestricted Embedding in Iframe dashlet5.3 Medium
- gitlabImproper Restriction of Rendered UI Layers or Frames in GitLab6.4 Medium
- inaba denki sangyo co., ltd. ac-wps-11ac, ac-pd-wps-11ac, ac-pd-wps-11ac-p +3 more +5 moreImproper restriction of rendered UI layers or frames issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac...6.5 Medium
- amauric tarteaucitron.js, amauri tarteaucitronjs +1 moretarteaucitron.js allows UI manipulation via unrestricted CSS injection5.5 Medium
- jtekt electronics corporation hmi viewjet c-more seriesImproper restriction of rendered UI layers or frames issue exists in HMI ViewJet C-more series,...4.3 Medium
- google androidIn multiple locations, there is a possible way to mislead the user into enabling malicious phone...7.3 High
- google androidIn finishTransition of Transition.java, there is a possible way to bypass touch filtering...7.3 High
- google chromeInappropriate implementation in Permission Prompts in Google Chrome prior to 134.0.6998.35...4.3 Medium
- google chromeInappropriate implementation in Browser UI in Google Chrome on Android prior to 134.0.6998.35...4.3 Medium
- mozilla firefoxAndroid Intent confirmation prompt tapjacking using Select options7.1 High
- sap se commerce (backoffice)Missing Defense in Depth Against Clickjacking in SAP Commerce Backoffice6.8 Medium
- ibm applinxIBM ApplinX Clickjacking5.4 Medium
- mozilla firefox, thunderbird +1 moreFullscreen notification not properly displayed4.3 Medium
- mozilla firefox, thunderbird +1 moreFullscreen notification is not displayed when fullscreen is re-requested5.3 Medium
- nec corporation websam deploymentmanagerNEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset...5.3 Medium
- jupyter nbgrader`frame-ancestors: self` grants all users access to formgrader in nbgrader6.9 Medium
- typechoClickjacking vulnerability in typecho v1.2.1.6.4 Medium
- huawei harmonyosCross-process screen stack vulnerability in the UIExtension module Impact: Successful...5.5 Medium
- huawei harmonyosCross-process screen stack vulnerability in the UIExtension module Impact: Successful...6.2 Medium
- google androidIn multiple locations, there is a possible way to obtain access to a folder due to a tapjacking...7.8 High
- ibm infosphere information serverIBM InfoSphere Information Server clickjacking5.2 Medium
- scidsg hushlineContent Security Policy appears to be missing in software and production setup7.1 High
- huawei harmonyosCross-process screen stack vulnerability in the UIExtension module Impact: Successful...5.5 Medium
- huawei harmonyosCross-process screen stack vulnerability in the UIExtension module Impact: Successful...6.2 Medium
- mozilla firefox, firefox for ios +1 moreUnder certain circumstances, navigating to a webpage would result in the address missing from the...5.4 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA crafted URL containing Arabic script and whitespace characters could have hidden the true...5.4 Medium
- mozilla firefox, thunderbird +1 moreMalicious websites may have been able to user intent confirmation through tapjacking. This could...8.1 High
- gitlabImproper Restriction of Rendered UI Layers or Frames in GitLab6.8 Medium
- google androidIn visitUris of multiple files, there is a possible information disclosure due to a confused...5.5 Medium
- Show moreLoading…