PT-2025-44442 · Movary · Movary

Published 2025-10-30 · Updated 2025-12-08 · CVE-2025-64115

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Movary versions prior to 0.69.0

Description Movary, a web application for tracking movie watch history, is susceptible to an open redirect issue. Versions up to and including 0.68.0 directly utilize the HTTP Referer header value for redirects within multiple settings endpoints. This allows an attacker to craft a malicious link that redirects users to a site controlled by the attacker, potentially enabling phishing attacks. The issue is addressed in version 0.69.0. The vulnerable setting endpoints utilize the HTTP Referer header without proper validation.

Recommendations Upgrade to version 0.69.0 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-64115

GHSA-PM58-79JW-Q79F

Affected Products

Movary

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64115.json · Exploit
• 🔥 https://github.com/leepeuker/movary/security/advisories/GHSA-pm58-79jw-q79f · Exploit
• https://github.com/leepeuker/movary/commit/716f703b4464ffdb0365c406f3660d275495769f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-64115 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64115 · Vendor Advisory
• https://github.com/leepeuker/movary/pull/713 · Note
• https://twitter.com/VulmonFeeds/status/1983970819563819175 · Twitter Post
• https://t.me/CVEtracker/36217 · Telegram Post
• https://t.me/cveNotify/145146 · Telegram Post
• https://twitter.com/CVEnew/status/1983954729022411157 · Twitter Post