A reflected cross-site scripting (XSS) vulnerability has been identified in the Query Console component of Progress MarkLogic Server. The flaw affects versions prior to 11.3.6 and 12.0.3. A remote attacker can exploit this vulnerability by luring an authenticated administrator to visit a specially crafted URL. Upon successful exploitation, the attacker can execute arbitrary JavaScript within the administrator's browser session. This allows for credential capture and the ability to perform privileged administrative actions on behalf of the victim. The attack requires social engineering to trick the administrator into clicking a malicious link. Progress has issued a security bulletin classifying this as a critical security alert. Users are advised to upgrade to the patched versions 11.3.6 or 12.0.3 immediately.