CVE-2012-4281: Itechscripts Travelon Express

High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in Travelon Express 6.2.2 allow remote attackers to execute arbitrary SQL commands via the hid parameter to (1) holiday.php or (2) holiday_book.php, (3) id parameter to pages.php, (4) fid parameter to admin/airline-edit.php, or (5) cid parameter to admin/customer-edit.php.

Affected products

• Itechscripts Travelon Express: version 6.2.2 only

Published 2012-08-13. Last modified 2026-06-16.