Werss We Mp Rss
Approved changes feed: RSS · Atom
cpe:2.3:a:rachelos:werss_we-mp-rss:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Rachelos (53547436-ff22-5f6f-8cae-84a8504df524) |
|---|---|
| Product | Werss We Mp Rss (33bb7d63-9787-5f1b-9fe9-5f17b6ddb364) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-2825 |
vulnerable | 2026-06-08 07:55:17.576027 |
rachelos WeRSS we-mp-rss Article fix.py fix_html cross site scripting
LOW (3.5)
A vulnerability has been found in rachelos WeRSS we-mp-rss up to 1.4.8. This impacts the function fix_html of the file tools/fix.py of the component Article Module. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-02-20T06:02:06.763Z
Updated: 2026-02-23T10:31:15.505Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-2216 |
vulnerable | 2026-06-08 07:55:16.732470 |
rachelos WeRSS we-mp-rss tools.py download_export_file path traversal
MEDIUM (4.3)
A flaw has been found in rachelos WeRSS we-mp-rss up to 1.4.8. Impacted is the function download_export_file of the file apis/tools.py. Executing a manipulation of the argument filename can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used.
Published: 2026-02-09T05:02:06.373Z
Updated: 2026-02-23T09:56:58.204Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-2215 |
vulnerable | 2026-06-08 07:55:16.731942 |
rachelos WeRSS we-mp-rss JWT auth.py default key
LOW (3.7)
A vulnerability was detected in rachelos WeRSS we-mp-rss up to 1.4.8. This issue affects some unknown processing of the file core/auth.py of the component JWT Handler. Performing a manipulation of the argument SECRET_KEY results in use of default cryptographic key. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit is now public and may be used.
Published: 2026-02-09T04:32:06.678Z
Updated: 2026-02-23T09:56:44.351Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13174 |
vulnerable | 2026-06-08 07:04:31.734370 |
rachelos WeRSS we-mp-rss Webhook mps.py do_job server-side request forgery
MEDIUM (6.3)
A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7. Affected by this vulnerability is the function do_job of the file /rachelos/we-mp-rss/blob/main/jobs/mps.py of the component Webhook Module. Executing manipulation of the argument web_hook_url can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.
Published: 2025-11-14T18:32:06.004Z
Updated: 2025-11-14T18:57:17.553Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.