Critical Severity Vulnerability
This vulnerability has been rated as Critical severity. Immediate action is recommended.
CVE-2026-23840
Critical
Low
Medium
High
Critical
9.3
CVSS Score
Published: Jan 19, 2026
Last Modified: Jan 19, 2026
Vulnerability Description
Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryDeleted=`. Version 0.70.0 fixes the issue.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Attack Vector
N
Attack Complexity
L
Privileges Required
N
User Interaction
R
Scope
C
Confidentiality
H
Integrity
H
Availability
N
References & Resources
-
https://github.com/leepeuker/movary/blob/main/public/js/settings-account-location.js#L204security-advisories@github.com
-
https://github.com/leepeuker/movary/releases/tag/0.70.0security-advisories@github.com
-
https://github.com/leepeuker/movary/security/advisories/GHSA-pj3m-gmq8-2r57security-advisories@github.com
Severity Details
9.3
out of 10.0
Critical
Key Information
- Published Date
- January 19, 2026
