CVE-2015-20114

RealtyScript 4.0.2 Cross-Site Scripting via Multiple Parameters

CVSS 5.1 MEDIUMEPSS 0.3%CWE-79

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.1EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

15 Mar 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Next Click Ventures RealtyScript 4.0.2 contains a cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious input through multiple parameters that are not properly sanitized. Attackers can craft requests with injected script payloads in vulnerable parameters to execute code in users' browser sessions within the context of the affected application.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected products

Next Click Ventuers · RealtyScript

References

https://www.exploit-db.com/exploits/38496 https://www.vulncheck.com/advisories/realtyscript-cross-site-scripting-via-multiple-parameters http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5269.php