CVE-2026-9195
CriticalCVSS 9.3Summary
A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perform privileged actions on the administrator's behalf.
Risk Assessment
Risk of administrator account takeover and full compromise of the MarkLogic system, including access to sensitive data and unauthorized privileged operations.
Recommendation
Immediately upgrade Progress MarkLogic Server to version 11.3.6 or 12.0.3 (or later) which contains the fix. Additionally, educate administrators to avoid clicking on suspicious links.
Original NVD description (English source)
A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perform privileged actions on the administrator's behalf.