Movary, an application for tracking movie watch history, has an insufficient input validation flaw that permits attackers to inject arbitrary JavaScript through the `?categoryUpdated=` query parameter. When a victim follows a crafted URL, the unsanitized value is rendered in the page, allowing the attacker to execute client‑side code. This can lead to theft of session cookies, credential compromise, or phishing attacks, creating a high confidentiality and integrity risk for users. The vulnerability is classified as Cross‑Site Scripting (CWE‑79) and input validation failure (CWE‑20).

The vulnerable product is Movary developed by leepeuker. All releases older than version 0.70.0 are susceptible. Version 0.70.0 and later include the fix that sanitizes the `categoryUpdated` parameter.

The CVSS score of 9.3 denotes critical severity, yet the EPSS score of <1% suggests that current exploitation likelihood is low. Nevertheless, the attack vector relies on a user visiting a malicious URL, making social engineering or phishing plausible. The vulnerability is not listed in the CISA KEV catalog, but its severe impact warrants prompt remediation. Once the application is upgraded, the exposure is removed.