Security readout for executives and security teams
Plain-English summary
Movie_Recommend v1.0.0 reportedly accepts unsafe input through the sort parameter on /loadingmore. An unauthenticated remote attacker could use this flaw to access sensitive database information and potentially alter data or disrupt availability. The reported CVSS score is 9.8, making exposed installations an urgent concern.
Executive priority
Treat confirmed internet-accessible deployments as an immediate remediation priority because exploitation reportedly requires no authentication or user interaction. Quickly establish whether the application exists, limit exposure, and obtain authoritative remediation guidance. Do not claim compromise solely from vulnerability presence; review logs and affected data paths.
Technical view
CVE-2026-79569 is a reported SQL injection vulnerability, classified as CWE-89, in Movie_Recommend v1.0.0. The vulnerable input is the sort parameter at /loadingmore. Its CVSS 3.1 vector indicates network access, low attack complexity, no privileges, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely where Movie_Recommend v1.0.0 makes /loadingmore reachable over a network. The structured affected-product data lists vendor, product, and versions as unavailable, so organizations should confirm deployments by application name, version, route, and source provenance rather than relying on CPE matching.
Exploitation context
The source bundle reports that a crafted SQL statement can access sensitive database information. The CVSS vector indicates unauthenticated remote exploitation with low complexity. The CVE is not listed in KEV, and the supplied sources do not establish active exploitation, public weaponization, or observed attacks.
Researcher notes
Evidence is limited to the CVE records and one GitHub advisory reference. The narrative names Movie_Recommend v1.0.0, but structured affected fields contain only unavailable values and no CPEs. No fixed version or vendor-endorsed mitigation is supplied. Validate implementation details defensively without testing production systems destructively.
Mitigation direction
- Identify and restrict network access to exposed Movie_Recommend v1.0.0 deployments.
- Check project or vendor guidance for an official patch or supported remediation.
- Apply parameterized database queries and strict allowlisting for the sort parameter if maintaining the application.
- Use least-privileged database credentials to reduce potential impact.
- Monitor application and database logs for anomalous requests involving /loadingmore.
Validation and detection
- Inventory applications and repositories for Movie_Recommend v1.0.0.
- Confirm whether /loadingmore is deployed and reachable from untrusted networks.
- Review the sort parameter handling for dynamic SQL construction.
- Verify database queries use parameterization and an allowlist of permitted sort values.
- Review relevant web and database logs for suspicious historical activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-79569 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/fangtang7/CVE/blob/main/movie/sql.mdCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.