The vulnerability is a server-side request forgery in SourceCodester RSS Feed Parser 1.0, affecting the file_get_contents function. By supplying a crafted URL, an attacker can cause the application to make arbitrary HTTP requests on the server's behalf, potentially reaching internal services or disclosing sensitive data. The flaw is classified under CWE‑918 and allows remote exploitation without authentication.

Affected specifically is the SourceCodester RSS Feed Parser product, version 1.0. No other versions or components were listed in the CNA data.

The CVSS base score is 5.3 indicating moderate severity. The exploit is already publicly available and can be launched remotely, though the EPSS score is not provided and the vulnerability is not present in the CISA KEV catalog. As the server side request forgery can be triggered via the file_get_contents function, an attacker who can interact with the application may abuse it to reach privileged internal endpoints, potentially leading to data exposure or further lateral movement.