CWE-1021.

OpenClaw has Canvas route hardening for mixed-trust deployments

• Cross-site scripting (XSS)
• CWE-1021

<2026.2.21 · fixed in 2026.2.21

Clickjacking in Google Android

• Google Android
• CWE-1021

Lack of protection mechanisms against Clickjacking attacks

• CGM CLININET
• CWE-1021

Tenda F3 Clickjacking in Web Management Interface

• Shenzhen Tenda Technology Co., Ltd. Tenda F3
• CWE-1021

XWiki vulnerable to click-jacking through CSS injection in comments

• CWE-1021

>=17.5.0, <17.9.0 || >=17.0.0-rc-1, <17.4.6 || <16.10.13 · fixed in 17.9.0, 17.4.6, 16.10.13

Clickjacking in Apple iOS and iPadOS

• Apple iOS and iPadOS
• CWE-1021

Dokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors headers

• dokploy
• CWE-1021

WeGIA Clickjacking Vulnerability

• LabRedesCefetRJ WeGIA
• CWE-1021

CVE-2025-15032: Increased Spoofing risk; custom new window missing about:blank

• The Browser Company of New York Dia
• CWE-1021

Paragon Automation: A clickjacking vulnerability in the web server configuration has been addressed

• Juniper Networks Paragon Automation (Pathfinder, Planner, Insights)
• CWE-1021

Clickjacking in SICK AG TDC-X401GL

• SICK AG TDC-X401GL
• CWE-1021

PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes.

• CWE-1021

Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature

• Cross-site scripting (XSS)
• CWE-1021

<314.251111.0 · fixed in 314.251111.0

Address bar spoofing risk in ArcSearch on Android

• The Browser Company of New York ArcSearch
• CWE-1021

Address bar spoofing risk in Arc Search on iOS

• The Browser Company of New York ArcSearch
• CWE-1021

HCL BigFix Remote Control is vulnerable to an insecure CSP configuration

• HCL Software BigFix Remote Control
• CWE-693
• CWE-1021

Clickjacking in Inaba Denki Sangyo Co., Ltd. CHOCO TEI WATCHER mini (IB-MCT001)

• Inaba Denki Sangyo Co., Ltd. CHOCO TEI WATCHER mini (IB-MCT001)
• CWE-1021

Clickjacking in Google Chrome

• Google Chrome
• CWE-1021

Clickjacking in Google Android

• Google Android
• CWE-1021

Clickjacking in Google Android

• Google Android
• CWE-1021

FeehiCMS is vulnerable to reverse tabnabbing

• CWE-1021

<=2.1.1 · no fixed version yet

IBM Concert Software clickjacking

• IBM Concert Software
• CWE-1021

Dia: Increased Spoof Risk; Missing full screen toast

• The Browser Company of New York Dia
• CWE-1021

iFrame Injection in Mikrogrup's Shopside

• Shopside
• CWE-1021

CLICKJACKING

• Circutor TCPRS1plus
• CWE-1021

Clickjacking in Open-Xchange GmbH OX App Suite

• Open-Xchange GmbH OX App Suite
• CWE-1021

Phpgurukul Hostel Management System 2.1 is vulnerable to clickjacking.

• CWE-1021

HCL MyXalytics is affected by the use of vulnerable/outdated versions

• HCL Software MyXalytics
• CWE-1021
• CWE-1104

FreshRSS: Double clickjacking can lead to privilege escalation

• FreshRSS
• CWE-1021

FressRSS: Clickjacking can lead to XSS and/or privilege escalation

• FreshRSS
• Cross-site scripting (XSS)
• CWE-1021

XSS in Mevzuattr Software's MevzuatTR

• MevzuatTR
• Cross-site scripting (XSS)
• CWE-1021

Clickjacking in Google Android

• Google Android
• CWE-1021

Clickjacking in Google Android

• Google Android
• CWE-1021

iFrame Injection in Akinsoft's LimonDesk

• Akinsoft LimonDesk
• CWE-1021

Cross-Frame Scripting (XFS) in BoomCMS

• BoomCMS
• CWE-1021

Clickjacking in Google Android

• Google Android
• CWE-1021

Clickjacking in Google Android

• Google Android
• CWE-1021

IBM Cognos Command Center clickjacking

• IBM Cognos Command Center
• CWE-1021

Portabilis i-Diario Login Page ui layer

• Portabilis i-Diario
• CWE-1021

Clickjacking in JetBrains YouTrack

• JetBrains YouTrack
• CWE-1021

HAX CMS application pages vulnerable to clickjacking

• CWE-1021

<11.0.13 · fixed in 11.0.13

yangzongzhuan RuoYi Image Source ui layer

• yangzongzhuan RuoYi
• CWE-1021

Clickjacking vulnerability on the management web application of TP-LINK Archer C1200

• TP-Link System Inc. Archer C1200
• CWE-1021

CVE-2025-27455

• Endress+Hauser MEAC300-FNADE4
• CWE-1021

Sunshine clickjacking in the UI leads to unauthorized actions being performed

• LizardByte Sunshine
• CWE-1021

IBM Datacap clickjacking

• IBM Datacap
• CWE-1021

Clickjacking in Google Chrome

• Google Chrome
• CWE-1021

HTTPS-Only exception screen lacked anti-clickjacking delay

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-1021

Clickjacking

• SICK AG SICK Field Analytics
• SICK AG SICK Media Server
• CWE-1021

Dashboards and iFrames can link malicious web content

• SICK AG SICK Field Analytics
• CWE-1021

@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability

• CWE-1021

<11.0.0 · fixed in 11.0.0

Clickjacking vulnerability could have led to leaking saved payment card details

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-1021

DIFY vulnerable to Clickjacking Attack

• langgenius dify
• CWE-1021

EspoCRM allows unrestricted Embedding in Iframe dashlet

• espocrm
• CWE-1021

Improper Restriction of Rendered UI Layers or Frames in GitLab

• GitLab
• CWE-1021

Clickjacking in Inaba Denki Sangyo Co., Ltd. AC-WPS-11ac and others

• Inaba Denki Sangyo Co., Ltd. AC-WPS-11ac
• Inaba Denki Sangyo Co., Ltd. AC-WPS-11ac-P
• CWE-1021

tarteaucitron.js allows UI manipulation via unrestricted CSS injection

• CWE-1021

<1.20.1 · fixed in 1.20.1

Clickjacking in JTEKT ELECTRONICS CORPORATION HMI ViewJet C-more series

• JTEKT ELECTRONICS CORPORATION HMI ViewJet C-more series
• CWE-1021

Clickjacking in Google Chrome

• Google Chrome
• CWE-1021

Clickjacking in Google Chrome

• Google Chrome
• CWE-1021