CVE-2025-0421

MediumCVSS 4.7/10Last modified Oct 19, 2026

Description

Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay.

This issue affects Shopside: through 05022025.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-1021

Affected software

No affected versions have been published.

Timeline

Published
Nov 19, 2025
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-04228.6An authenticated user in the "bestinformed Web" application can execute commands on the underlying server running the application. (Remote CCVE-2025-04235.3In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site CVE-2025-04245.1In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple authenticated stored cross-site scCVE-2025-04258.5Via the GUI of the "bestinformed Infoclient", a low-privileged user is by default able to change the server address of the "bestinformed SerCVE-2025-04266.2A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet readCVE-2025-04277.8Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture KCVE-2025-04287.2The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via desCVE-2025-04297.2The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via desCVE-2025-04307.5Belledonne Communications Linphone-Desktop is vulnerable to a NULL Dereference vulnerability, which could allow a remote attacker to creatCVE-2025-04315.8Enterprise Protection contains a vulnerability in URL rewriting that allows an unauthenticated remote attacker to send an email which bypassCVE-2025-04325.7EWON Flexy 202 transmits user credentials in clear text with no encryption when a user is added, or user credentials are changed via its webCVE-2025-04335.4The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnera
CVE-2025-0421: Medium severity, CVSS 4.7 | Vulnix