CVE-2026-6953

HTML injection vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an attacker to send an email containing malicious HTML code to a victim via the contact form. To exploit this vulnerability, the attacker must send a request using the 'nombreApellidos', 'dirección ', and 'comentarios ' parameters to '/processContact.do'.

• CWE-79

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-intermark-its-webcontrol-cms

Published

Jun 30, 2026

Last Modified

Oct 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-69522Heap-based buffer overflow in Visual Studio allows an unauth…8.8
• CVE-2026-69524Use after free in Active Directory Domain Services allows an…8.1
• CVE-2026-69525Use after free in Windows Remote Desktop Services allows an …9.8
• CVE-2026-69527Out-of-bounds read in Windows USB Mass Storage Class Driver …5.5
• CVE-2026-69528Missing authentication for critical function in Windows Shel…7.8
• CVE-2026-69529Heap-based buffer overflow in Microsoft Office Access allows…8.8
• CVE-2026-69530Use after free in Reliable Multicast Transport Driver (RMCAS…8.1
• CVE-2026-69531Unintended proxy or intermediary ('confused deputy') in Micr…5.5
• CVE-2026-69532Out-of-bounds read in Windows NTFS allows an authorized atta…7.8
• CVE-2026-69534Improper neutralization of special elements used in a comman…7.8
• CVE-2026-69535Numeric truncation error in Windows Spaceport.sys allows an …7.8
• CVE-2026-69536Use after free in Windows Remote Desktop Services allows an …7.1