CVE-2026-6954 is a CWE-79 Cross-Site Scripting vulnerability affecting Intermark IT WebControl CMS v3.5. It allows remote attackers to inject malicious scripts via the 'urlDestino' parameter in the '/portal.do' endpoint. Exploitation can result in execution of arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, phishing, or unauthorized actions. The vulnerability is publicly known but no official fix or patch has been documented. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, no confidentiality, integrity, or availability impact, but limited scope impact on security integrity.

Successful exploitation enables attackers to execute arbitrary JavaScript code in the victim's browser context, which can lead to theft of session cookies, display of phishing content, or execution of unauthorized actions on behalf of the user. This compromises user security and privacy but does not directly affect system confidentiality, integrity, or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on URLs containing the 'urlDestino' parameter in the affected endpoint. Implementing web application firewalls (WAFs) with XSS filtering rules may provide temporary mitigation.