Medium severity · published Jun 30, 2026
CVE-2026-6953
Multiple vulnerabilities in Intermark IT's WebControl CMS
5.1
CVSS
0.4%
EPSS
No
On KEV
Description
HTML injection vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an attacker to send an email containing malicious HTML code to a victim via the contact form. To exploit this vulnerability, the attacker must send a request using the 'nombreApellidos', 'dirección ', and 'comentarios ' parameters to '/processContact.do'.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WC
WebControl CMS · Intermark IT
0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6953
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6953
www.incibe.es
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-intermark-its-webcontrol-cms
More from WebControl CMS
5.1
CVE-2026-6954
Multiple vulnerabilities in Intermark IT's WebControl CMS