CVE-2025-13174

MEDIUM

rachelos WeRSS we-mp-rss <= 1.4.7 - Server-Side Request Forgery via Webhook Module

Title source: llm

Description

A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7. Affected by this vulnerability is the function do_job of the file /rachelos/we-mp-rss/blob/main/jobs/mps.py of the component Webhook Module. Executing manipulation of the argument web_hook_url can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.

References (4)

Core 4

Core References

Permissions Required, VDB Entry vdb-entry technical-description

https://vuldb.com/?id.332465

Permissions Required, VDB Entry signature permissions-required

https://vuldb.com/?ctiid.332465

Permissions Required, VDB Entry third-party-advisory

https://vuldb.com/?submit.684803

Various Sources exploit

https://www.notion.so/SSRF-vulnerability-in-WeRSS-WebHook-module-29bea92a3c4180a192b5caa9078bfb18

Scores

CVSS v3 6.3

EPSS 0.0023

EPSS Percentile 13.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-918

Status published

Products (8)

rachelos/WeRSS we-mp-rss 1.4.0

rachelos/WeRSS we-mp-rss 1.4.1

rachelos/WeRSS we-mp-rss 1.4.2

rachelos/WeRSS we-mp-rss 1.4.3

rachelos/WeRSS we-mp-rss 1.4.4

rachelos/WeRSS we-mp-rss 1.4.5

rachelos/WeRSS we-mp-rss 1.4.6

rachelos/WeRSS we-mp-rss 1.4.7

Published Nov 14, 2025

Tracked Since Feb 18, 2026