CVE-2026-6954— Multiple vulnerabilities in Intermark IT's WebControl CMS
Possible ATT&CK Techniques 3AI
T1539 · Steal Web Session Cookie T1059.007 · JavaScript T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Intermark IT | WebControl CMS | < * | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-6954
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Multiple vulnerabilities in Intermark IT's WebControl CMS
Source: NVD (National Vulnerability Database)
Vulnerability Description
Cross-Site Scripting (XSS) vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an attacker to execute JavaScript code or inject a dynamic iframe into the victim’s browser by sending a malicious URL via the 'urlDestino' parameter in '/portal.do'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, display phishing interfaces, or perform actions on the user’s behalf.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Intermark IT WebControl CMS 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Intermark IT WebControl CMS是西班牙Intermark IT公司的一款企业级内容管理系统。 Intermark IT WebControl CMS 3.5版本存在跨站脚本漏洞，该漏洞源于跨站脚本问题，通过'/portal.do'的'urlDestino'参数发送恶意URL，可能导致攻击者在受害者浏览器中执行JavaScript代码或注入动态iframe，用于窃取会话Cookie等敏感用户数据、显示钓鱼界面或代表用户执行操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Intermark IT | WebControl CMS | 0 ~ * | - |
II. Public POCs for CVE-2026-6954
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-6954
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-6954 (1)
IV. Related Vulnerabilities
Same weakness: CWE-79
- CVE-2026-54498
view_component: around_render HTML-Safety Bypass - CVE-2026-54163
secure_headers: CSP directive injection via sandbox, plugin_ - CVE-2026-15091
Multiple Vulnerabilities in IBM Engineering AI hub. - CVE-2026-16073
AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrateg - CVE-2026-48015
Shopware: Stored XSS via SVG file upload — no SVG sanitizati
V. Comments for CVE-2026-6954
No comments yet