PT-2025-46996 · Rachelos · Werss We-Mp-Rss

Din4 · Published 2025-11-14 · Updated 2025-11-15 · CVE-2025-13174

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions rachelos WeRSS we-mp-rss versions up to 1.4.7

Description A flaw exists in the Webhook Module of rachelos WeRSS we-mp-rss. The do job function within the /rachelos/we-mp-rss/blob/main/jobs/mps.py file is susceptible to server-side request forgery (SSRF). Manipulation of the web hook url argument can trigger this issue, allowing for remote exploitation. The exploit is publicly available.

Recommendations Versions prior to 1.4.7 should be updated. As a temporary workaround, consider restricting or disabling the use of the web hook url argument in the do job function until a patch is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-13174

Affected Products

Werss We-Mp-Rss

References · 8

• 🔥 https://notion.so/SSRF-vulnerability-in-WeRSS-WebHook-module-29bea92a3c4180a192b5caa9078bfb18 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13174 · Security Note
• https://vuldb.com/?submit.684803 · Note
• https://twitter.com/CVEnew/status/1989441994775744638 · Twitter Post
• https://t.me/CVEtracker/37356 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1989489007055548755 · Twitter Post
• https://vuldb.com/?ctiid.332465 · Note
• https://vuldb.com/?id.332465 · Note