CVE-2025-52987

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A clickjacking vulnerability exists in the web portal of Juniper Networks Paragon Automation (Pathfinder, Planner, Insights) due to the application's failure to set appropriate X-Frame-Options and X-Content-Type HTTP headers. This vulnerability allows an attacker to trick users into interacting with the interface under the attacker's control.

This issue affects all versions of Paragon Automation (Pathfinder, Planner, Insights) before 24.1.1.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-1021

Affected software

Vendor	Product	Versions
Juniper Networks	Paragon Automation (Pathfinder, Planner, Insights)	< 24.1.1

References

https://kb.juniper.net/JSA103145Vendor Advisory
https://supportportal.juniper.net/Permissions Required

Timeline

Published: Jan 15, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-529886.7An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the CLI of Juniper Networks J CVE-2025-529895.1An Improper Neutralization of Delimiters vulnerability in the UI of Juniper Networks Junos OS and Junos OS Evolved allows a local, authentic CVE-2025-52997.3A vulnerability was found in SourceCodester Client Database Management System 1.0. It has been declared as critical. This vulnerability affe CVE-2025-529913.2The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This a CVE-2025-529923.2The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes t CVE-2025-529935.6A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the buil CVE-2025-529944.9gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7 CVE-2025-529956.6File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2025-529964.3File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2025-529977.5File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2025-529989.8Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be CVE-2025-529998.7jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions