CVE-2026-79569

Movie_Recommend v1.0.0 contains a SQL injection flaw (CWE-89) in the sort parameter of the /loadingmore endpoint, allowing attackers to submit crafted SQL statements directly to the backend database. Because the CVSS vector shows network exploitation with no privileges or user interaction required, any unauthenticated attacker who can reach the vulnerable endpoint can trigger the injection. A successful attack exposes sensitive information stored in the database, and the critical 9.8 score indicates high impacts on confidentiality, integrity, and availability, so data alteration or disruption may also be possible. Only deployments running Movie_Recommend v1.0.0 are affected. There is currently no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS (0.4%, 33rd percentile) suggests exploitation in the next 30 days is unlikely.

What to do: No fixed version is specified in the available data, so check the project's repository or vendor channels for a patched release before deploying. In the meantime, restrict network access to the /loadingmore endpoint, ensure the sort parameter is handled with parameterized queries or strict input validation, and consider WAF/virtual-patching rules that flag SQL syntax in that parameter. Operators running Movie_Recommend 1.0.0 should review application and database logs for anomalous queries and monitor for an official update.