EUVD-2026-53430
GHSA-m93w-6m66-f899
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Unauthenticated attacker (PR:N) but requires admin to click a crafted link (UI:R); script escapes into the privileged session (S:C) yielding high C/I, no availability impact (A:N).
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perform privileged actions on the administrator's behalf.
AnalysisAI
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets a remote, unauthenticated attacker execute arbitrary JavaScript in the browser of an authenticated administrator who is lured to a crafted URL. Because the payload runs with the admin's authenticated session, it can harvest credentials/session tokens and perform privileged database and configuration actions on the admin's behalf. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a victim who is an already-authenticated MarkLogic administrator opens an attacker-crafted URL pointing at the Query Console; the attacker themselves needs no account (PR:N) but cannot succeed without this administrator interaction (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N drives the 9.3 (Critical) score primarily through the scope change (S:C) and high confidentiality/integrity impact - an XSS that pivots into the admin session justifiably crosses a security boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious URL targeting the MarkLogic Query Console and delivers it to an administrator via phishing or a watering-hole link. When the logged-in admin opens it, injected JavaScript runs in their authenticated session, silently exfiltrating session credentials and issuing privileged queries or configuration changes to the database. … |
| Remediation | Vendor-released patch: upgrade to MarkLogic Server 11.3.6 or 12.0.3 (or later) as documented in the Progress advisory at https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Progress MarkLogic Server instances in your environment and determine if they are running versions prior to 11.3.6 (for 11.x line) or 12.0.3 (for 12.x line); immediately restrict network access to the Query Console to trusted administrative networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Marklogic Server
View allPrivilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a l
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthentic
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote at
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged u
Privilege escalation in Progress MarkLogic Server's REST API document processing pipeline allows an authenticated user h
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote, unauthenticated attacker to trigge
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today