Vulnerabilities in iframe 2.9