Vulnerabilities in iframe 2.6