CVE-2025-49191CWE-1021

Dashboards and iFrames can link malicious web content

Medium · published June 12, 2025

CVSS v3.1
4.8
EPSS
0%
Percentile
27.0
In the wild
Unconfirmed
What it is

Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, making it possible to attack other users that access the dashboard by including malicious code. The attack is only possible if the attacker is authorized to create new dashboards or iFrame widgets.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00347 · 27.0th percentile
Weakness
CWE-1021 · Improper Restriction of Rendered UI Layers or Frames
Published
2025-06-12T14:08Z
EPSS history
Timeline
  • 12 JUN 14:08Z
    Dashboards and iFrames can link malicious web content
    cvelistv5