CVE-2025-49192— Clickjacking
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-49192
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Clickjacking
Source: NVD (National Vulnerability Database)
Vulnerability Description
The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives. This could potentially reveal confidential information or allow others to take control of their computer while clicking on seemingly innocuous objects.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
不当限制渲染UI层或帧
Source: NVD (National Vulnerability Database)
Vulnerability Title
SICK Field Analytics和SICK Media Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SICK Field Analytics和SICK Media Server都是德国SICK公司的产品。SICK Field Analytics是一款用于评估制造数据的软件。SICK Media Server是一款媒体服务器。 SICK Field Analytics 和SICK Media Server存在安全漏洞，该漏洞源于容易受到点击劫持攻击，可能导致机密信息泄露或系统控制权被获取。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SICK AG | SICK Field Analytics | all versions | - | |
| SICK AG | SICK Media Server | 0 ~ 1.5 | - |
II. Public POCs for CVE-2025-49192
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-49192
请登录查看更多情报信息。
Same Patch Batch · SICK AG · 2025-06-12 · 20 CVEs total
| CVE-2025-49199 | 8.8 HIGH | Backup files can be modified and uploaded |
| CVE-2025-49181 | 8.6 HIGH | Configurations endpoint does not require authorization |
| CVE-2025-49182 | 7.5 HIGH | Credential disclosure |
| CVE-2025-49183 | 7.5 HIGH | Unencrypted communication (HTTP) |
| CVE-2025-49194 | 7.5 HIGH | Unencrypted communication |
| CVE-2025-49184 | 7.5 HIGH | Information disclosure to unauthorized user |
| CVE-2025-49197 | 6.5 MEDIUM | Deprecated TLS version supported |
| CVE-2025-49200 | 6.5 MEDIUM | Unencrypted backup contains sensitive information |
| CVE-2025-49196 | 6.5 MEDIUM | Deprecated TLS version supported |
| CVE-2025-49185 | 5.5 MEDIUM | Stored Cross-Site-Script |
| CVE-2025-49189 | 5.3 MEDIUM | Cookie missing HttpOnly flag |
| CVE-2025-49188 | 5.3 MEDIUM | Sensitive Data in URL |
| CVE-2025-49187 | 5.3 MEDIUM | User enumeration |
| CVE-2025-49186 | 5.3 MEDIUM | No brute-force protection |
| CVE-2025-49195 | 5.3 MEDIUM | No protection against brute-force attacks |
| CVE-2025-49191 | 4.8 MEDIUM | Dashboards and iFrames can link malicious web content |
| CVE-2025-49190 | 4.3 MEDIUM | Server-Side Request Forgery |
| CVE-2025-49193 | 4.2 MEDIUM | Missing HTTP Security Headers |
| CVE-2025-49198 | 3.1 LOW | Poor quality of randomness in authorization tokens |
IV. Related Vulnerabilities
Same product: SICK Field Analytics
Same weakness: CWE-1021
- CVE-2026-3254
Improper Restriction of Rendered UI Layers or Frames in GitL - CVE-2026-2378
Address bar spoofing risk in ArcSearch on Android - CVE-2025-62328
HCL Nomad server on Domino is affected by a missing default - CVE-2025-58405
Lack of protection mechanisms against Clickjacking attacks - CVE-2026-27511
Tenda F3 Clickjacking in Web Management Interface
V. Comments for CVE-2025-49192
No comments yet