Insufficient input validation in the Movary web application allows an attacker to embed malicious scripts via the query parameter '?categoryDeleted=' in HTTP requests. This flaw permits the execution of arbitrary JavaScript in the context of the target user’s browser, Open‑Source CPElist indicates CWE-79 cross‑site scripting through user input handling. A compromised session can lead to credential theft, session hijacking, phishing, or defacement of user data, with integrity and confidentiality at risk. The vulnerability is reported with a CVSS score of 9.3, indicating a high likelihood of exploitation and severe impact.

The affected vendor is Lee Peuker, product Movary. All releases prior to version 0.70.0 are vulnerable; the fix was released in 0.70.0 and later versions are believed to be immune.

The low EPSS (<1%) suggests a very small probability of widespread use, yet the high CVSS reflects the potential for severe damage if an attacker crafts a malicious URL or injects a payload in the categoryDeleted parameter. The attack vector is inferred to be a reflected or stored client‑side XSS, requiring no authentication; a malicious link can compromise any user who visits the target URL. The vulnerability is not listed in the CISA KEV catalog at this time, but the severity warrants any organization deploying Movary to act promptly.