PT-2025-44443 · Movary · Movary

Published 2025-10-30 · Updated 2025-12-08 · CVE-2025-64116

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Movary versions prior to 0.69.0

Description Movary is a web application used for tracking and exploring movie watch history. Prior to version 0.69.0, the login page accepts a redirect parameter without proper validation. This allows attackers to redirect authenticated users to arbitrary external websites. The vulnerable parameter is redirect.

Recommendations Update to version 0.69.0 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-64116

GHSA-7Q72-X26X-7F8G

Affected Products

Movary

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64116.json · Exploit
• 🔥 https://github.com/leepeuker/movary/security/advisories/GHSA-7q72-x26x-7f8g · Exploit
• https://github.com/leepeuker/movary/commit/716f703b4464ffdb0365c406f3660d275495769f · Patch
• https://osv.dev/vulnerability/CVE-2025-64116 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64116 · Security Note
• https://github.com/leepeuker/movary/pull/713 · Note
• https://t.me/CVEtracker/36218 · Telegram Post
• https://twitter.com/CVEnew/status/1983954731077640439 · Twitter Post
• https://t.me/cveNotify/145147 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1983965699937632546 · Twitter Post