Vendor

Onyx

1 brief RSS

Onyx Craft: Stored Cross-Site Scripting via iframe sandbox bypass (CVE-2026-116004)

Onyx Craft versions through 5.0.0 contain a stored Cross-Site Scripting vulnerability in the output preview panel caused by insecure iframe sandbox configuration, allowing malicious preview content to access the parent document DOM.

Onyx Craft xss web-vulnerability cve-2026-116004

1t 1c 48m ago