CWE-1021 Improper Restriction of Rendered UI Layers or Frames
Description
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-1021 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-jmc6-2wr8-h3wj | CVE-2026-87995 | HIGH |
Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin |
2026-09-10 | |
| GHSA-fcw5-x6j4-ccmp | CVE-2026-44727 | CRITICAL |
Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP |
2026-08-28 | |
| GHSA-p77j-g7h5-r2vw | - | HIGH |
GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4) |
2026-08-19 | |
| GHSA-9f4c-93c8-jc8g | CVE-2026-70608 | HIGH |
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path |
2026-08-05 | |
| GHSA-x8rc-wpg4-grpf | CVE-2026-70600 | LOW |
Electron: Cross-origin iframe can position native autofill popup |
2026-08-05 | |
| GHSA-3xpf-xq7r-v8c5 | CVE-2026-70486 | HIGH |
Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin |
2026-08-04 | |
| GHSA-w7w5-5gcp-38rw | CVE-2026-47723 | HIGH |
nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.) |
2026-06-08 | |
| GHSA-cjv3-m589-v3rx | - | MODERATE |
OpenClaw has Canvas route hardening for mixed-trust deployments |
2026-03-03 | |
| GHSA-74rh-c5rh-88vg | CVE-2026-26000 | MODERATE |
XWiki vulnerable to click-jacking through CSS injection in comments |
2026-02-12 | |
| GHSA-24v3-254g-jv85 | - | LOW |
Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature |
2025-12-19 | |
| GHSA-w756-rf26-7rmr | CVE-2025-63522 | MODERATE | - |
FeehiCMS is vulnerable to reverse tabnabbing |
2025-12-02 |
| GHSA-54vw-f4xf-f92j | CVE-2025-54139 | MODERATE |
HAX CMS application pages vulnerable to clickjacking |
2025-07-23 | |
| GHSA-v3ph-2q5q-cg88 | CVE-2025-49139 | MODERATE |
@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability |
2025-06-09 | |
| GHSA-7524-3396-fqv3 | CVE-2025-31138 | MODERATE |
tarteaucitron.js allows UI manipulation via unrestricted CSS injection |
2025-04-07 | |
| GHSA-mq73-g4qr-fgcq | CVE-2024-2383 | MODERATE |
Clickjacking in zenml |
2025-01-21 | |
| GHSA-fcr8-4r9f-r66m | CVE-2025-23205 | HIGH |
nbgrader's `frame-ancestors: self` grants all users access to formgrader |
2025-01-17 | |
| GHSA-m379-x4xc-38x9 | CVE-2022-3167 | CRITICAL |
rdiffweb vulnerable to Improper Restriction of Rendered UI Layers or Frames |
2024-10-25 | |
| GHSA-rwh8-h525-4jvj | CVE-2020-5679 | MODERATE | - |
EC-CUBE Improper Restriction of Rendered UI Layers or Frames |
2024-04-25 |
| GHSA-2xpp-75vr-22vq | CVE-2018-17192 | MODERATE |
Improper Restriction of Rendered UI Layers or Frames in Apache nifif |
2024-03-04 | |
| GHSA-5xfx-55x4-j223 | CVE-2024-0669 | HIGH |
Cross-Frame Scripting vulnerability has been found on Plone CMS |
2024-01-26 | |
| GHSA-gc95-5mmp-mp6j | CVE-2023-38873 | MODERATE | - |
Economizzer vulnerable to Clickjacking |
2023-10-02 |
| GHSA-gm7m-rqf8-jx4m | CVE-2023-0780 | MODERATE | - |
Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit |
2023-02-22 |
| GHSA-h8r9-467r-vjjf | CVE-2023-0057 | MODERATE |
pyLoad vulnerable to Improper Restriction of Rendered UI Layers or Frames |
2023-01-11 | |
| GHSA-7xp8-7wqx-5hqx | CVE-2020-2105 | LOW |
Jenkins REST APIs vulnerable to clickjacking |
2022-12-19 | |
| GHSA-xqv2-3vvq-qg6r | CVE-2022-36182 | MODERATE |
Hashicorp Boundary vulnerable to clickjacking |
2022-10-31 |