A web‑based HTML injection flaw exists in Intermark IT's WebControl CMS version 3.5. By sending a crafted request containing malicious HTML in the "nombreApellidos", "dirección", and "comentarios" fields to the /processContact.do endpoint, an attacker can cause the CMS to include that HTML in an email it sends to a victim. The injected content may be executed when the victim views the email, leading to cross‑site scripting (XSS) in the email client, phishing, or the spread of additional malicious payloads.

Intermark IT WebControl CMS version 3.5 is affected. No other vendors or versions are listed as impacted.

The CVSS score of 5.1 indicates moderate seriousness. The EPSS score is not available, and the vulnerability is not in CISA's KEV list, suggesting no current widespread exploitation reports. Exploitation requires remote access to the web application's form endpoint and the ability to craft an HTTP POST request with the specified parameters. Because the vulnerability is tied to a publicly accessible contact form, attackers could target the site without additional privileges, making it a remote, network‑level threat.