CVE-2025-64115CWE-601

CVE-2025-64115

Medium · published October 30, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
16.2
In the wild
Unconfirmed
What it is

Movary is a web application to track, rate and explore your movie watch history. Versions up to and including 0.68.0 use the HTTP Referer header value directly for redirects in multiple settings endpoints, allowing a crafted link to cause an open redirect to an attacker-controlled site and facilitate phishing. This vulnerability is fixed in 0.69.0.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00255 · 16.2th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2025-10-30T22:15Z
Affected products (1)
ProductVersionsFixed in
leepeuker/movary< 0.69.00.69.0
References (3)
https://github.com/leepeuker/movary/commit/716f703b4464ffdb0365c406f3660d275495769f · [email protected]https://github.com/leepeuker/movary/pull/713 · [email protected]https://github.com/leepeuker/movary/security/advisories/GHSA-pm58-79jw-q79f · [email protected]
EPSS history
Timeline
  • 30 OCT 17:39Z
    Movary unvalidated Referer header allows open redirect and phishing
    cvelistv5