CVE-2012-4281: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Travelon Express 6.2.2 allow remote attackers to execute arbitrary SQL commands via the hid parameter to 1 holiday.php or 2 holidaybook.php, 3 id parameter to pages.php, 4 fid parameter to admin/airline-edit.php, or 5 cid parameter to...

CVE-2012-2939: Undefined Security Weakness

Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using 1 airline-edit.php, 2 hotel-image-add.php, or 3 hotel-add.php...