Critical · published January 19, 2026
🚨 A simple URL tweak could unleash chaos! In earlier versions of Movary, a crafty cross-site scripting vulnerability lurks in the `?categoryDeleted=` parameter. 🔥 Think of it like a sneaky prankster at a movie theater who swaps the film reels, resulting in unintended chaos and confusion amongst the audience — that’s what XSS does in your web app! If exploited, an attacker could inject malicious scripts into your users' sessions, leading to compromised accounts, stolen cookies, or even defaced pages. It’s an absolute nightmare scenario that could wreck user trust and ruin your app's reputation!
Think of it like a sneaky prankster at a movie theater who swaps the film reels, resulting in unintended chaos and confusion amongst the audience — that’s what XSS does in your web app! This cross-site scripting vulnerability allows attackers to insert harmful scripts into web pages viewed by other users due to insufficient input validation in versions prior to 0.70.0.
If exploited, an attacker could inject malicious scripts into your users' sessions, leading to compromised accounts, stolen cookies, or even defaced pages. It’s an absolute nightmare scenario that could wreck user trust and ruin your app's reputation! Upgrade your Movary installation to version 0.70.0 immediately to slam the door on this vulnerability. Additionally, review input validation practices throughout your application to ensure no similar weaknesses remain. You've got this! With these steps, you can ensure your app is protected and your users stay safe. 🛡️