Stored Cross-Site Scripting in RealtyScript Web Application by Next Click Ventures
CVE-2015-20116

5.1MEDIUM

Key Information:

Vendor

Next Click Ventures

Status
Realtyscript
Vendor
CVE Published:
15 March 2026

Badges

👾 Exploit Exists

What is CVE-2015-20116?

RealtyScript version 4.0.2 has a vulnerability that allows an attacker to upload CSV files without proper sanitization, particularly manipulating the filename parameter in multipart form data. This oversight can lead to arbitrary JavaScript execution within users' browsers when the uploaded file is processed or displayed. Consequently, an attacker could inject harmful scripts that may compromise user data or exploit session hijacking.

Affected Version(s)

RealtyScript 4.0.2

References

https://www.exploit-db.com/exploits/38496
exploit
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-52...
third-party-advisory
https://www.vulncheck.com/advisories/realtyscript-stored-...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.