PT-2026-25722 · Nextclickventures · Realtyscript

Published 2026-03-15 · Updated 2026-03-16 · CVE-2015-20119

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RealtyScript version 4.0.2

Description RealtyScript 4.0.2 contains a stored cross-site scripting issue that allows authenticated attackers to inject malicious HTML and iframe elements. Attackers can submit POST requests to the add page action with crafted iframe payloads in the text parameter within the pages.php admin interface. This allows the storage of malicious content that executes in the browsers of users viewing the affected pages. The vulnerable parameter is text.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize the text parameter in the pages.php file to prevent the injection of malicious HTML and iframe elements. Restrict access to the pages.php admin interface to authorized personnel only.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-20119

Affected Products

Realtyscript

References · 5

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2015-5269.php · Exploit
• 🔥 https://exploit-db.com/exploits/38496 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-20119 · Security Note
• https://t.me/CVEtracker/47449 · Telegram Post
• https://vulncheck.com/advisories/realtyscript-stored-cross-site-scripting-via-text-parameter-in-pages-php · Note