CVE-2026-9195
Critical · CVSS 9.3- CVSS
- 9.3
- nvd
- EPSS
- 0.41%
- 34th pct
- KEV
- No
- Class
- other
- CWE-22, CWE-79
Description
A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perform privileged actions on the administrator's behalf.
References
Status: profiled · ingested 2026-09-03T18:00:49.000Z