Movary, a web‑based film‑tracking application, suffers from an unescaped input parameter that allows malicious script code to be executed in a victim’s browser. By adding a carefully crafted query string using the `?categoryCreated=` parameter, an attacker can embed JavaScript that runs with the same privileges as the application page. The resulting impact includes theft of session cookies, impersonation, or arbitrary actions performed on behalf of the user. This vulnerability is classified as CWE‑79 (Cross‑Site Scripting) and also features an input‑validation weakness (CWE‑20).

All installations of the Movary application built by the vendor `leepeuker` and deploying versions earlier than 0.70.0 are affected. The vulnerability is specific to the web interface where the query parameter is processed, and no patched version prior to 0.70.0 is available.

The CVSS score of 9.3 indicates critical severity, and the EPSS score is reported as less than 1 %. Although the likelihood of exploitation in the wild is low, the vulnerability is publicly disclosed and has no current official exploitation reports, and it is not listed in the CISA KEV catalog. Attackers would need only to craft a URL containing the malicious payload and induce a user to visit it, making the exploit trivial when the target is exposed to web traffic. The solution is straightforward and delivered by the vendor in a new release.