CVE-2015-20116

MEDIUM6.1

RealtyScript 4.0.2 Stored Cross-Site Scripting via CSV File Upload Filename

Published Mar 15, 2026

Modified Yesterday

Details

Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize CSV file uploads, allowing attackers to inject malicious scripts through filename parameters in multipart form data. Attackers can upload files with XSS payloads in the filename field to execute arbitrary JavaScript in users' browsers when the file is processed or displayed.

References

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2015-20116

DETECTION

https://www.exploit-db.com/exploits/38496

ADVISORY

https://www.vulncheck.com/advisories/realtyscript-stored-cross-site-scripting-via-csv-file-upload-filename

ADVISORY

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5269.php

CVSS Analysis

CVSS v4.0

5.1