CVE-2025-13174

MediumCVSS 6.3

Published: 14/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

A vulnerability has been identified in rachelos WeRSS we-mp-rss (up to 1.4.7) in the do_job function of jobs/mps.py in the Webhook Module. Manipulation of the web_hook_url argument leads to Server-Side Request Forgery. The exploit is publicly available.

Risk Assessment

An attacker can remotely exploit this vulnerability to send requests from the server to arbitrary locations, potentially accessing internal services or performing actions on behalf of the server.

Recommendation

Update WeRSS to a version later than 1.4.7 or remove the ability to manipulate the web_hook_url parameter. Restrict outbound network connections from the server.

Other vulnerabilities in WeRSS

CVE-2026-111687Critical
WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.

Original NVD description (English source)

A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7. Affected by this vulnerability is the function do_job of the file /rachelos/we-mp-rss/blob/main/jobs/mps.py of the component Webhook Module. Executing manipulation of the argument web_hook_url can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS