Cross-Site Request Forgery and XSS Vulnerabilities in RealtyScript by Next Click Ventures
CVE-2015-20113

6.9MEDIUM

Key Information:

Vendor

Next Click Ventuers

Status
Realtyscript
Vendor
CVE Published:
15 March 2026

Badges

👾 Exploit Exists

What is CVE-2015-20113?

RealtyScript version 4.0.2 by Next Click Ventures is susceptible to critical vulnerabilities that include cross-site request forgery (CSRF) and persistent cross-site scripting (XSS). These vulnerabilities enable attackers to exploit the application by injecting malicious scripts or initiating unauthorized administrative actions through crafted web pages. When users with valid authentication access these pages, they unknowingly trigger the execution of these attacks, potentially compromising user data and application integrity.

Affected Version(s)

RealtyScript 4.0.2

References

https://www.exploit-db.com/exploits/38496
exploit
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-52...
third-party-advisory
https://www.vulncheck.com/advisories/realtyscript-multipl...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.