rickmote

rickmote Rickmote Controller: Google Chromecast로 TV 하이재킹하기 Rickmote는 Chromecast를 하이재킹하고 연결된 TV에서 임의의 동영상을 재생하기 위한 Python 프로그램입니다. 이 해킹이 작동하는 방식에 대한 자세한 내용은 뉴욕에서 열린 HOPE X의 "Google Chromecast로 이웃에게 Rickroll 시키기" 강연에서 공개되었습니다. 여기에서 확인하세요: https://www.youtube.com/watch?v=Bv9rlT8Zgvw 또한 이 모든 기능은...

CVE-2026-92586

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify video access permissions in the setapicomment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoi...

EUVD-2026-42128

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticated attackers can supply arbitrary video IDs to read sensitive AI-generated content and trigger unauthorized AI generatio...

CVE-2026-59704 Cap - Missing Access Control in Video AI Metadata Endpoint

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticated attackers can supply arbitrary video IDs to read sensitive AI-generated content and trigger unauthorized AI generatio...

PT-2026-56279

Name of the Vulnerable Software and Affected Versions Cap affected versions not specified Description The 'GET /api/video/ai' endpoint fails to validate user ownership or membership. This allows authenticated attackers to provide arbitrary video IDs to access private AI metadata, such as titles,...

CVE-2025-34438

Summary: CVE-2025-34438 affects AVideo versions prior to 20.1. It is an insecure direct object reference (IDOR) where users with upload permissions can modify the rotation metadata of arbitrary videos because the endpoint verifies upload capability but fails to enforce ownership/administrative ri...

EUVD-2025-4715

Malicious code in bioql PyPI...

CVE-2025-0955

CVE-2025-0955 affects the VidoRev Extensions WordPress plugin. A missing capability check on AJAX action vidorev_import_single_video allows unauthenticated users to import arbitrary YouTube videos. Status: patched in Wordfence/patchstack records; remediation is to update to a version with the fix...

The vulnerability of the video file exchange function in Jitsi Meet software, which allows attackers to upload arbitrary video files.

The vulnerability of the video file exchange function in Jitsi Meet software for conducting video conferences is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to upload arbitrary video files remotely...