Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

movary — Vulnerabilities & Security Advisories 8

All 8 CVE vulnerabilities found in movary, with AI-generated Chinese analysis, references, and POCs.

Vendor: leepeuker

CVE IDTitleCVSSSeverityPublished
CVE-2026-40350 Movary User Management (/settings/users) has Authorization Bypass that Allows Low-Privileged Users to Enumerate All Users and Create Administrator Accounts CWE-863 8.8 High2026-04-18
CVE-2026-40349 Authenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=true CWE-862 8.8 High2026-04-18
CVE-2026-40348 Movary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing CWE-918 7.7 High2026-04-18
CVE-2026-23841 Movary vulnerable to Cross-site Scripting with `?categoryCreated=` param CWE-20 9.3 Critical2026-01-19
CVE-2026-23840 Movary vulnerable to Cross-site Scripting with `?categoryDeleted=` param CWE-20 9.3 Critical2026-01-19
CVE-2026-23839 Movary vulnerable to Cross-site Scripting with `?categoryUpdated=` param CWE-20 9.3 Critical2026-01-19
CVE-2025-64115 Movary unvalidated Referer header allows open redirect and phishing CWE-601 6.1AIMediumAI2025-10-30
CVE-2025-64116 Movary vulnerable to an open redirect CWE-601 6.1AIMediumAI2025-10-30

All 8 known CVE vulnerabilities affecting movary with full Chinese analysis, references, and POCs where available.