This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the Query Console component of Progress MarkLogic Server. An attacker can craft a URL that, when visited by an authenticated administrator, executes arbitrary JavaScript code in the administrator's browser session. This enables the attacker to capture credentials and perform actions with the administrator's privileges. The affected versions explicitly include 11.0.0 and 12.0.0. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of an authenticated administrator's browser session. This can lead to credential compromise and unauthorized privileged operations within the MarkLogic Server environment. The vulnerability has a CVSS 3.1 base score of 9.3, indicating critical severity with high impact on confidentiality and integrity but no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on untrusted or suspicious URLs related to the Query Console. Monitoring for updates from Progress Software Corporation is recommended to apply official patches once available.