Critical severity9.3NVD Advisory· Published Jan 19, 2026· Updated Jun 17, 2026

CVE-2026-23840

Description

Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is ?categoryDeleted=. Version 0.70.0 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Leepeuker/Movaryv52 versions
< 0.70.0+ 1 more
- (no CPE)range: < 0.70.0
- cpe:2.3:a:leepeuker:movary:*:*:*:*:*:*:*:*range: <0.70.0
Movary/Movaryllm-fuzzy
Range: <0.70.0

Patches

Vulnerability mechanics

References

github.com/leepeuker/movary/security/advisories/GHSA-pj3m-gmq8-2r57nvdExploitVendor Advisory
github.com/leepeuker/movary/blob/main/public/js/settings-account-location.jsnvdProduct
github.com/leepeuker/movary/releases/tag/0.70.0nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.605
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000