PT-2026-25721 · Nextclickventures · Realtyscript

Published 2026-03-15 · Updated 2026-03-16 · CVE-2015-20118

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RealtyScript version 4.0.2

Description RealtyScript 4.0.2 contains a stored cross-site scripting issue in the location name parameter of the admin locations interface. Attackers can submit POST requests to the ''locations.php'' endpoint with JavaScript payloads in the location name field, potentially executing arbitrary code in administrator browsers.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize the location name parameter before using it in the application.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-20118

Affected Products

Realtyscript

References · 5

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2015-5269.php · Exploit
• 🔥 https://exploit-db.com/exploits/38496 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-20118 · Security Note
• https://t.me/CVEtracker/47448 · Telegram Post
• https://vulncheck.com/advisories/realtyscript-stored-cross-site-scripting-via-location-name-parameter · Note