CriticalCVSS 10.0
EPSS 0.52%
Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.
Vendor
Brandexponents vulnerabilities
6 published CVES affecting Brandexponents, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 6
- Critical
- 1
- High
- 3
- Medium
- 2
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
Latest Brandexponents CVEs
Newest publication first
-
-
HighCVSS 8.1 EPSS 0.48%
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in brandexponents Oshine allows PHP Local File Inclusion. This issue affects Oshine: from n/a before 7.3.0.
-
CVE-2025-58660 WordPress Oshine Core Plugin <= 1.5.5 - Broken Access Control Vulnerability
PublishedMediumCVSS 5.4 EPSS 0.27%Missing Authorization vulnerability in brandexponents Oshine Core oshine-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oshine Core: from n/a through <= 1.5.5.
-
HighCVSS 7.1 EPSS 0.26%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandexponents Oshine Modules oshine-modules allows Reflected XSS.This issue affects Oshine Modules: from n/a through < 3.3.8.
-
MediumCVSS 5.4 EPSS 0.26%
Server-Side Request Forgery (SSRF) vulnerability in brandexponents Oshine Modules oshine-modules.This issue affects Oshine Modules: from n/a through < 3.3.8.
-
HighCVSS 8.1 EPSS 83.2% Framework module
The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extensi...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.