CVE-2015-20116
RealtyScript 4.0.2 Stored Cross-Site Scripting via CSV File Upload Filename
- State
- Published
- Severity
- 5.1 Medium
- Published
- Mar 15, 2026
- Updated
- Oct 27, 2026
- Reserved
- Mar 15, 2026
Description
Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize CSV file uploads, allowing attackers to inject malicious scripts through filename parameters in multipart form data. Attackers can upload files with XSS payloads in the filename field to execute arbitrary JavaScript in users' browsers when the file is processed or displayed.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
RealtyScriptNext Click Ventures |
|
References
- ExploitDB-38496exploit
- Zero Science Lab Disclosurethird-party-advisory
- VulnCheck Advisory: RealtyScript 4.0.2 Stored Cross-Site Scripting via CSV File Upload Filenamethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.