EUVD-2026-40271
GHSA-865c-wrhg-fwg8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered reflected XSS requires user interaction (UI:R), changes scope to victim's browser (S:C), enabling cookie theft (C:L) and unauthorized actions (I:L), with no availability impact.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
Lifecycle Timeline
1DescriptionCVE.org
Cross-Site Scripting (XSS) vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an attacker to execute JavaScript code or inject a dynamic iframe into the victim’s browser by sending a malicious URL via the 'urlDestino' parameter in '/portal.do'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, display phishing interfaces, or perform actions on the user’s behalf.
AnalysisAI
Reflected Cross-Site Scripting in Intermark IT's WebControl CMS v3.5 allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL targeting the 'urlDestino' parameter of the '/portal.do' endpoint. Successful exploitation enables session cookie theft, phishing overlay injection, and unauthorized actions performed within the victim's authenticated session context. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 5.1 reflects a meaningful subsequent-system integrity impact via the user's browser.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the application fails to sanitize or encode user-supplied input before reflecting it back in the HTTP response rendered by the browser. The affected parameter 'urlDestino' in the '/portal.do' endpoint accepts attacker-controlled input that is embedded into the page without adequate output encoding, allowing injection of JavaScript tags or dynamic iframe elements. The affected product, identified via CPE cpe:2.3:a:intermark_it:webcontrol_cms:*:*:*:*:*:*:*:*, is WebControl CMS version 3.5 developed by Spanish vendor Intermark IT. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms the attack is network-reachable with no complexity or privilege requirements, but requires active user interaction - consistent with a URL-delivered reflected XSS pattern rather than a stored or DOM-based variant.
RemediationAI
Upgrade to a patched version of WebControl CMS as directed by the vendor Intermark IT and the INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-intermark-its-webcontrol-cms. No specific fixed version number is confirmed in the available data, so direct contact with the vendor is required to obtain remediation details. As a compensating control, organizations can deploy a Web Application Firewall (WAF) with XSS filtering rules targeting the '/portal.do' endpoint and the 'urlDestino' parameter - note that WAF bypass is possible and this should not replace patching. Additionally, enforcing HTTP-only and Secure flags on session cookies will reduce the impact of successful XSS exploitation by preventing JavaScript-based cookie theft, though it does not prevent other XSS abuse such as UI redressing or unauthorized API calls. If the '/portal.do' endpoint is not required for external users, restricting access to internal networks removes the network attack surface entirely.
More in Webcontrol Cms
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today