Skip to content
OpenAdvisories

Vendor

rachelos

6 known vulnerabilities.

Products

WeRSS we-mp-rss 4 we-mp-rss 2
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-110617

    we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint

    we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can sup…

    rachelos we-mp-rss
  • Medium 4.3
    CVE-2026-2216

    rachelos WeRSS we-mp-rss tools.py download_export_file path traversal

    A flaw has been found in rachelos WeRSS we-mp-rss up to 1.4.8. Impacted is the function download_export_file of the file apis/tools.py. Executing a manipulation of the argument filename can lead to path traversal. The attack can be launched remotely. The expl…

    rachelos WeRSS we-mp-rss
  • Medium 6.3
    CVE-2025-13174

    rachelos WeRSS we-mp-rss Webhook mps.py do_job server-side request forgery

    A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7. Affected by this vulnerability is the function do_job of the file /rachelos/we-mp-rss/blob/main/jobs/mps.py of the component Webhook Module. Executing manipulation of the argument web_hoo…

    rachelos WeRSS we-mp-rss