RealtyScript 4.0.2 Stored Cross-Site Scripting via CSV File Upload Filename
Priority MEDIUM 62CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize CSV file uploads, allowing attackers to inject malicious scripts through filename parameters in multipart form data. Attackers can upload files with XSS payloads in the filename field to execute arbitrary JavaScript in users' browsers when the file is processed or displayed.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00251 16th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Next Click Ventures | RealtyScript | 4.0.2 | — | No fix listed | CNA |
- RealtyScript VendorNext Click Ventures Affected 4.0.2 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextclickventures:realtyscript:4.0.2:*:*:*:*:*:*:* | 4.0.2 | Vulnerable | Next Click Ventures |
- cpe:2.3:a:nextclickventures:realtyscript:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·Next Click Ventures
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2015-20116
- 2026-10-03 Alias added: GHSA-w89r-c7m2-q2v5
References
More Next Click Ventures Realtyscript vulnerabilities
- TI-2015-08095 RealtyScript 4.0.2 Multiple Time-based Blind SQL Injection CVSS 4.0HIGH 8.8
- TI-2015-08096 RealtyScript 4.0.2 SQL Injection via u_id and agent Parameters CVSS 4.0HIGH 8.8
- TI-2015-08092 RealtyScript 4.0.2 Cross-Site Request Forgery Unauthorized User Creation CVSS 4.0MEDIUM 6.9
- TI-2015-08088 RealtyScript 4.0.2 Multiple Cross-Site Request Forgery and Persistent Cross-Site Scripting Vulnerabilities CVSS 4.0MEDIUM 6.9
- TI-2015-08093 RealtyScript 4.0.2 Stored Cross-Site Scripting via location_name Parameter CVSS 4.0MEDIUM 5.1
- TI-2015-08094 RealtyScript 4.0.2 Stored Cross-Site Scripting via text Parameter in pages.php CVSS 4.0MEDIUM 5.1
Sources
- CVE-2015-20116 · CVE Program
- CVE-2015-20116 · NVD
- FIRST EPSS
- GHSA-w89r-c7m2-q2v5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences