This vulnerability in WebControl CMS v3.5 arises from improper neutralization of input in the 'urlDestino' parameter of the '/portal.do' page, enabling Cross-Site Scripting (CWE-79). An attacker can craft a malicious URL that executes JavaScript or injects iframes in the victim's browser context. This can be used to steal session cookies, display phishing content, or perform unauthorized actions. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction needed, and limited impact on confidentiality and integrity.

Successful exploitation allows attackers to execute arbitrary scripts in the context of the victim's browser session on the affected CMS, potentially leading to session hijacking, phishing, or unauthorized actions performed as the user. The impact is limited to the confidentiality and integrity of the user's session and data accessible via the browser.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on URLs containing the 'urlDestino' parameter in the affected CMS. Implementing web application firewall (WAF) rules to detect and block malicious payloads targeting this parameter may help mitigate risk.