What’s Vulnerable › Products

leepeuker movary vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your leepeuker movary version is affected

Latest leepeuker movary vulnerabilities

• CVE-2026-40350 — Movary User Management (/settings/users) has Authorization Bypass that Allows Low-Privileged Users to Enumerate All Users and Create Administrator Accounts (CVSS 8.8)
• CVE-2026-40349 — Authenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=true (CVSS 8.8)
• CVE-2026-40348 — Movary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing (CVSS 7.7)
• CVE-2026-23841 — Movary vulnerable to Cross-site Scripting with `?categoryCreated=` param (CVSS 6.1)
• CVE-2026-23840 — Movary vulnerable to Cross-site Scripting with `?categoryDeleted=` param (CVSS 6.1)
• CVE-2026-23839 — Movary vulnerable to Cross-site Scripting with `?categoryUpdated=` param (CVSS 6.1)
• CVE-2025-64116 — Movary vulnerable to an open redirect (CVSS 6.1)
• CVE-2025-64115 — Movary unvalidated Referer header allows open redirect and phishing (CVSS 6.1)