Stored Cross-Site Scripting in Next Click Ventures RealtyScript
CVE-2015-20118

5.1MEDIUM

Key Information:

Vendor

Next Click Ventures

Status
Realtyscript
Vendor
CVE Published:
15 March 2026

Badges

👾 Exploit Exists

What is CVE-2015-20118?

RealtyScript 4.0.2 from Next Click Ventures contains a stored cross-site scripting vulnerability that can be exploited through the location_name parameter in the admin locations interface. Attackers can exploit this flaw by submitting crafted POST requests to the locations.php endpoint, allowing them to inject malicious JavaScript code. Successful exploitation could lead to arbitrary code execution in the browsers of administrators, potentially compromising the security of sensitive information and application integrity.

Affected Version(s)

RealtyScript 4.0.2

References

https://www.exploit-db.com/exploits/38496
exploit
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-52...
third-party-advisory
https://www.vulncheck.com/advisories/realtyscript-stored-...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.