CVE-2012-2939
Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote...
CVE-2012-2939 is a medium vulnerability (CVSS 6.5) in Itechscripts Travelon Express, published May 27, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.84%, the 90th percentile. No source names a fixed version.
- Severity
- 6.5 MediumCVSS 2.0, NVD
- Exploit chance
- 3.84%EPSS, 90th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) airline-edit.php, (2) hotel-image-add.php, or (3) hotel-add.php.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Travelon Express CMS 6.2.2 - Multiple Vulnerabilities | 2012-05-13 |
What each source reports
NVD Score used
Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) airline-edit.php, (2) hotel-image-add.php, or (3) hotel-add.php.
- Record
CVE-2012-2939- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) airline-edit.php, (2) hotel-image-add.php, or (3) hotel-add.php.
- Record
CVE-2012-2939- Updated
- 2026-11-02
EUVDEUVD-2012-2918No score
Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) airline-edit.php, (2) hotel-image-add.php, or (3) hotel-add.php.
- Record
EUVD-2012-2918- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qqqh-wm2v-8949No score
Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote...
Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) airline-edit.php, (2) hotel-image-add.php, or (3) hotel-add.php.
- Record
GHSA-qqqh-wm2v-8949- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/53500
exchange.xforce.ibmcloud.com/vulnerabilities/75542
osvdb.org/81889
iel-sayed.blogspot.com/2012/05/travelon-express-cms-v622-multiple-web.html
vulnerability-lab.com/get_content.php?id=530
exploit-db.com/exploits/18871
nvd.nist.gov/vuln/detail/CVE-2012-2939
github.com/advisories/GHSA-qqqh-wm2v-8949