Back to Database
Status published
Medium
CVE-2015-20118
RealtyScript 4.0.2 Stored Cross-Site Scripting via location_name Parameter
Vulnerability Description
Next Click Ventures RealtyScript 4.0.2 contains a stored cross-site scripting vulnerability in the location_name parameter of the admin locations interface. Attackers can submit POST requests to the locations.php endpoint with JavaScript payloads in the location_name field to execute arbitrary code in administrator browsers.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-20118
Credits & Attribution
No credits recorded in the NVD database.
References
More from Next Click Ventures
View All →CVE-2015-20121
RealtyScript 4.0.2 SQL Injection via u_id and agent Parameters
High
8.8
CVE-2015-20120
RealtyScript 4.0.2 Multiple Time-based Blind SQL Injection
High
8.8
CVE-2015-20119
RealtyScript 4.0.2 Stored Cross-Site Scripting via text Parameter in pages.php
Medium
5.1
CVE-2015-20117
RealtyScript 4.0.2 Cross-Site Request Forgery Unauthorized User Creation
Medium
6.9
CVE-2015-20116
RealtyScript 4.0.2 Stored Cross-Site Scripting via CSV File Upload Filename
Medium
5.1
Affected Vendor
Next Click Ventures
View all reports →Affected Software
RealtyScript
Vulnerable Versions:
4.0.2
Timeline
Official Publish:
March 15th, 2026
Last Modified:
May 24th, 2026
Added to House:
July 19th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N