VULNERABILITY INTELLIGENCE
CVE-2026-6954
EPSS probability0.44%
CISA KEVNot currently listed
Published2026-06-30
Last modified2026-10-25
Description
Cross-Site Scripting (XSS) vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an attacker to execute JavaScript code or inject a dynamic iframe into the victim’s browser by sending a malicious URL via the 'urlDestino' parameter in '/portal.do'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, display phishing interfaces, or perform actions on the user’s behalf.
Weakness classification
- cve-coordination@incibe.es: CWE-79