CVE-2012-2939
Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote...
CVE-2012-2939 is a medium vulnerability (CVSS 6.5) in Itechscripts Travelon Express, published May 27, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.84%, the 90th percentile. No source names a fixed version.
Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) airline-edit.php, (2) hotel-image-add.php, or (3) hotel-add.php.
Exploit likelihood
What each source reports
NVD Score used
Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) airline-edit.php, (2) hotel-image-add.php, or (3) hotel-add.php.
- Record
CVE-2012-2939- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) airline-edit.php, (2) hotel-image-add.php, or (3) hotel-add.php.
- Record
CVE-2012-2939- Updated
- 2026-11-02
EUVDEUVD-2012-2918 No score
Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) airline-edit.php, (2) hotel-image-add.php, or (3) hotel-add.php.
- Record
EUVD-2012-2918- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qqqh-wm2v-8949 No score
Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote...
Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) airline-edit.php, (2) hotel-image-add.php, or (3) hotel-add.php.
- Record
GHSA-qqqh-wm2v-8949- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Travelon Express CMS 6.2.2 - Multiple Vulnerabilities | 2012-05-13 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD |
References
securityfocus.com/bid/53500
exchange.xforce.ibmcloud.com/vulnerabilities/75542
osvdb.org/81889
iel-sayed.blogspot.com/2012/05/travelon-express-cms-v622-multiple-web.html
vulnerability-lab.com/get_content.php?id=530
exploit-db.com/exploits/18871
nvd.nist.gov/vuln/detail/CVE-2012-2939
github.com/advisories/GHSA-qqqh-wm2v-8949