CVE-2026-23839

Movary vulnerable to Cross-site Scripting with `?categoryUpdated=` param

CVSS 9.3 CRITICALEPSS 0.3%CWE-20 CWE-79

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

19 Jan 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryUpdated=`. Version 0.70.0 fixes the issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Affected products

leepeuker · movary

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/leepeuker/movary/blob/main/public/js/settings-account-location.js#L237 https://github.com/leepeuker/movary/releases/tag/0.70.0 https://github.com/leepeuker/movary/security/advisories/GHSA-v32w-5qx7-p3vq