CVE-2015-20116
MEDIUM
MEDIUM
Priority: 0.00
BB Relevance:
60/100
Published: 2026-03-15
Modified: 2026-10-27
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Active
AT:
None
VC:
None
VI:
None
VA:
None
Description
Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize CSV file uploads, allowing attackers to inject malicious scripts through filename parameters in multipart form data. Attackers can upload files with XSS payloads in the filename field to execute arbitrary JavaScript in users' browsers when the file is processed or displayed.