Vulnerabilities

TI-2012-03661 CVE-2012-4281 · GHSA-cr9v-vxqx-f7xm

Multiple SQL injection vulnerabilities in Travelon Express 6.2.2 allow remote attackers…

LOW 37

Multiple SQL injection vulnerabilities in Travelon Express 6.2.2 allow remote attackers to execute arbitrary SQL commands via the hid parameter to (1) holiday.php or (2) holiday_book.php, (3) id parameter to pages.php, (…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02161 Published 2012-08-13 No fix listed CWE-89

TI-2012-02551 CVE-2012-2939 · GHSA-qqqh-wm2v-8949

Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote…

LOW 35

Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) airline-edit.php, (2) hote…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.03843 Published 2012-05-27 No fix listed

TI-2012-02550 CVE-2012-2938 · GHSA-mxx5-2h9x-347v

Multiple cross-site scripting (XSS) vulnerabilities in Travelon Express 6.2.2 allow…

LOW 24

Multiple cross-site scripting (XSS) vulnerabilities in Travelon Express 6.2.2 allow remote attackers to inject arbitrary web script or HTML via the holiday name field to (1) holiday_add.php or (2) holiday_view.php.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01791 Published 2012-05-27 No fix listed CWE-79

Vulnerabilities

Filters

Multiple SQL injection vulnerabilities in Travelon Express 6.2.2 allow remote attackers…

Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote…

Multiple cross-site scripting (XSS) vulnerabilities in Travelon Express 6.2.2 allow…