Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 contain a cross‑site scripting vulnerability that allows a remote attacker to execute script in the context of an authenticated user’s browser session, which can lead to unauthorized actions or disclosure of user–specific information.

Product: Progress MarkLogic Server from Progress Software Corporation. Vulnerable releases are any 12.x builds older than version 12.1.0 and any 11.x builds older than version 11.3.7.

The CVSS score of 6.1 rates this as a medium‑severity vulnerability. No EPSS score is available, and it is not listed in the CISA KEV catalog. Exploitation requires remote access to a web interface and an authenticated user's session, indicating that the attack vector is remote but needs prior authentication. The absence of a high EPSS score suggests that widespread exploitation may not yet be observed, but the potential for session‑level compromise remains significant.