CVE-2012-2939: Itechscripts Travelon Express

Medium severity, CVSS 6.5. EPSS: 3.8% chance of exploitation in the next 30 days.

Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) airline-edit.php, (2) hotel-image-add.php, or (3) hotel-add.php.

Affected products

• Itechscripts Travelon Express: version 6.2.2 only

Published 2012-05-27. Last modified 2026-06-16.