Medium severity · published Mar 15, 2026
CVE-2015-20114
RealtyScript 4.0.2 Cross-Site Scripting via Multiple Parameters
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
Next Click Ventures RealtyScript 4.0.2 contains a cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious input through multiple parameters that are not properly sanitized. Attackers can craft requests with injected script payloads in vulnerable parameters to execute code in users' browser sessions within the context of the affected application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
RealtyScript · Next Click Ventuers
4.0.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-20114
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-20114
Exploit
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5269.php
Exploit
https://www.exploit-db.com/exploits/38496
Third Party Advisory
https://www.vulncheck.com/advisories/realtyscript-cross-site-scripting-via-multiple-parameters
More from RealtyScript
4.3
CVE-2015-20113
RealtyScript 4.0.2 Multiple Cross-Site Request Forgery and Persistent Cross-Site Scripting Vulnerabilities