Filtered by vendor Rachelos Subscriptions
Filtered by product Werss Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-111687 1 Rachelos 1 Werss 2026-10-21 9.8 Critical
WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.
CVE-2025-13174 1 Rachelos 1 Werss 2026-04-15 6.3 Medium
A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7. Affected by this vulnerability is the function do_job of the file /rachelos/we-mp-rss/blob/main/jobs/mps.py of the component Webhook Module. Executing manipulation of the argument web_hook_url can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.