Vulnerabilities > Itechscripts > Travelon Express > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2012-05-27 | CVE-2012-2939 | Remote vulnerability in Itechscripts Travelon Express 6.2.2 Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) airline-edit.php, (2) hotel-image-add.php, or (3) hotel-add.php. | 6.5 |
| 2012-05-27 | CVE-2012-2938 | Cross-Site Scripting vulnerability in Itechscripts Travelon Express 6.2.2 Multiple cross-site scripting (XSS) vulnerabilities in Travelon Express 6.2.2 allow remote attackers to inject arbitrary web script or HTML via the holiday name field to (1) holiday_add.php or (2) holiday_view.php. | 4.3 |