Vulnerability · Published Jan 19, 2026 · Assigned by GitHub_M
CVE-2026-23841Movary vulnerable to Cross-site Scripting with `?categoryCreated=` param
Critical 9.3
In plain English
A critical-severity improper input validation in movary from leepeuker. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.3%top 81.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryCreated=`. Version 0.70.0 fixes the issue.
Affected products (as reported)
Weakness: CWE-20, CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
References
- https://github.com/leepeuker/movary/security/advisories/GHSA-v877-x568-4v5v x_refsource_CONFIRM
- https://github.com/leepeuker/movary/releases/tag/0.70.0 x_refsource_MISC