CVE-2026-6953

HTML injection vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an attacker to send an email containing malicious HTML code to a victim via the contact form. To exploit this vulnerability, the attacker must send a request using the 'nombreApellidos', 'dirección ', and 'comentarios ' parameters to '/processContact.do'.

• CWE-79

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-intermark-its-webcontrol-cms

Published

Jun 30, 2026

Last Modified

Jun 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6941radare2 prior to 6.1.4 contains a path traversal vulnerabili…7.8
• CVE-2026-6942radare2-mcp version 1.6.0 and earlier contains an os command…8.8
• CVE-2026-6947DWM-222W USB Wi-Fi Adapter developed by D-Link has a Brute-F…8.7
• CVE-2026-6948Velociraptor versions prior to 0.76.4 contain a resource exh…4.9
• CVE-2026-6951Versions of the package simple-git before 3.36.0 are vulnera…9.8
• CVE-2026-6952A post-authentication command injection vulnerability in the…7.2
• CVE-2026-6954Cross-Site Scripting (XSS) vulnerability in Intermark IT's W…5.1
• CVE-2026-6956ATutor is vulnerable to Reflected XSS in /install/install.ph…5.1
• CVE-2026-6957Mattermost Plugins versions <=1.1.5 fail to sanitize filenam…4.9
• CVE-2026-6959HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vuln…6
• CVE-2026-6960The BookingPress Pro plugin for WordPress is vulnerable to a…9.8
• CVE-2026-6961Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.1…7.6