This vulnerability in Intermark IT WebControl CMS v3.5 involves improper neutralization of input during web page generation, specifically in the contact form processing at '/processContact.do'. An attacker can exploit this by submitting malicious HTML code through the 'nombreApellidos', 'dirección ', and 'comentarios ' parameters, resulting in HTML injection that may lead to cross-site scripting attacks. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No vendor advisory or patch information is provided, and the product is not a cloud service.

Successful exploitation allows an attacker to inject malicious HTML content into emails sent via the contact form, which could lead to cross-site scripting attacks against recipients. This may result in execution of arbitrary scripts in the context of the victim's browser, potentially compromising user data or session information. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting or sanitizing input to the affected parameters 'nombreApellidos', 'dirección ', and 'comentarios ' in '/processContact.do'. Monitor vendor channels for updates and apply patches promptly once released.