Medium severity · published Jun 30, 2026
CVE-2026-6954
Multiple vulnerabilities in Intermark IT's WebControl CMS
5.1
CVSS
0.4%
EPSS
No
On KEV
Description
Cross-Site Scripting (XSS) vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an attacker to execute JavaScript code or inject a dynamic iframe into the victim’s browser by sending a malicious URL via the 'urlDestino' parameter in '/portal.do'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, display phishing interfaces, or perform actions on the user’s behalf.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WC
WebControl CMS · Intermark IT
0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6954
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6954
www.incibe.es
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-intermark-its-webcontrol-cms
More from WebControl CMS
5.1
CVE-2026-6953
Multiple vulnerabilities in Intermark IT's WebControl CMS