Threat database

WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.

CVE-2026-110617 is a missing authorization vulnerability in rachelos we-mp-rss version 1.5.3 and earlier. It affects the /api/v1/wx/tools/export/download endpoint, allowing unauthenticated attackers to download export archives by exploiting a commented-out authentication dependency. Attackers can specify an mp_id and guess timestamp-based filenames to retrieve archives and optionally delete them after download.

A vulnerability has been found in rachelos WeRSS we-mp-rss up to 1.4.8. This impacts the function fix_html of the file tools/fix.py of the component Article Module. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in rachelos WeRSS we-mp-rss up to 1.4.8. Impacted is the function download_export_file of the file apis/tools.py. Executing a manipulation of the argument filename can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used.

A vulnerability was detected in rachelos WeRSS we-mp-rss up to 1.4.8. This issue affects some unknown processing of the file core/auth.py of the component JWT Handler. Performing a manipulation of the argument SECRET_KEY results in use of default cryptographic key. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit is now public and may be used.

CVE-2025-13174 is a medium severity Server-Side Request Forgery (SSRF) vulnerability affecting rachelos WeRSS we-mp-rss versions up to 1.4.7. The flaw exists in the do_job function of the Webhook Module, where manipulation of the web_hook_url argument allows an attacker to induce the server to make unauthorized requests. This vulnerability can be exploited remotely without authentication or user interaction. While no known exploits are currently observed in the wild, public exploit code is available. The CVSS 4.0 score is 5.3, reflecting moderate impact on confidentiality, integrity, and availability with low attack complexity. European organizations using this software, particularly those integrating webhook functionality, could face risks of internal network scanning, data exfiltration, or interaction with internal services.