iframe-loader vulnerabilities

1 known vulnerability in iframe-loader from Haxtheweb. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.3 Critical severity

  haxcms-nodejs: Improper Neutralization of Input During Web Page Generation

  CVE-2026-46396Jun 5, 2026Haxtheweb

  HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `<iframe>` elements. The application allows `javascript:` URIs in the `src