Critical · published January 19, 2026
🚨 An insufficient validation flaw in Movary allows attackers to inject malicious scripts via the `?categoryCreated=` parameter! 🔥 Think of this as a movie review site that lets anyone slip in fake reviews without checking if they’re even related to the film — it could lead to some seriously confusing content! 🎬 With this vulnerability, a crafty attacker can execute cross-site scripting (XSS) payloads, potentially stealing user data, hijacking accounts, or even redirecting users to malicious sites. Imagine your innocent movie night turning into a nightmare with unwanted scripts running in the background!
Think of this as a movie review site that lets anyone slip in fake reviews without checking if they’re even related to the film — it could lead to some seriously confusing content! 🎬 This XSS vulnerability arises from insufficient input validation in versions prior to 0.70.0 of Movary, allowing attackers to manipulate the `?categoryCreated=` parameter to execute arbitrary scripts in users' browsers.
With this vulnerability, a crafty attacker can execute cross-site scripting (XSS) payloads, potentially stealing user data, hijacking accounts, or even redirecting users to malicious sites. Imagine your innocent movie night turning into a nightmare with unwanted scripts running in the background! To protect against this critical vulnerability, update Movary to version 0.70.0 immediately. Additionally, implement strict input validation and sanitation measures to prevent similar issues in the future. You’ve got this! Just follow these steps, and you’ll have your Movary app secured in no time! 🛡️