CVE-2026-85948

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control...

CVE-2026-85948 Improper privilege management in Progress MarkLogic Server Management API

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control...

CVE-2026-85948

Progress MarkLogic Server 12.x (before 12.1.0) and 11.x (before 11.3.7) are vulnerable to an XQuery injection flaw within a deprecated Management API package path. A remote attacker possessing manage-user-level privileges can exploit this flaw to achieve persistent unauthorized administrative con...

EUVD-2026-97506

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control...

CVE-2026-85948 Improper privilege management in Progress MarkLogic Server Management API

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control...

CVE-2026-85948: Improper Privilege Management

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control...

PT-2026-110641

Name of the Vulnerable Software and Affected Versions MarkLogic Server versions 11.0.0 through 11.3.6 MarkLogic Server versions 12.0.0 through 12.0.9 Description An XQuery injection flaw exists in a deprecated Management API package path. A remote attacker with manage-user-level privileges can...

PT-2022-5583

Name of the Vulnerable Software and Affected Versions Websoft HCM affected versions not specified Description The issue is related to insufficient neutralization of special elements in output, which can be exploited by a remote attacker to modify the logic of XQuery requests to the database by...

GitHub Security Lab: Java: CWE-652 Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')

This bug was reported directly to GitHub Security Lab...

Intramaps <= 7.0.128 Rev 318 Multiple Vulnerabilities - Active Check

Intramaps is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...