[CVE-2026-85948] Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQu…

Descripción técnica

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.

Puntuación CVSS

Score: 9.9/10 — Severidad: CRITICAL — Estado NIST: Received

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Debilidades (CWE)

CWE-269

Fuente oficial

Publicado en NIST NVD.