{"id":"CVE-2015-20117","title":"RealtyScript 4.0.2 Cross-Site Request Forgery Unauthorized User Creation","summary":"Next Click Ventures RealtyScript 4.0.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create unauthorized user accounts and administrative users by crafting malicious forms. Attackers can sub…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-352"],"vendor":"Next Click Ventures","product":"RealtyScript","affected":["RealtyScript 4.0.2"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-03-16T14:19:59.900856Z"},"exploitAvailable":true,"published":"2026-03-15","updated":"2026-10-27","sourceUpdated":"2026-10-27T00:40:42.104Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2015-20117","references":[{"url":"https://www.exploit-db.com/exploits/38496","label":"ExploitDB-38496"},{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5269.php","label":"Zero Science Lab Disclosure"},{"url":"https://www.vulncheck.com/advisories/realtyscript-cross-site-request-forgery-unauthorized-user-creation","label":"VulnCheck Advisory: RealtyScript 4.0.2 Cross-Site Request Forgery Unauthorized User Creation"}],"tags":["cve.org","exploit-available"],"epss":0.00203,"epssPercentile":0.10134,"ingestedAt":"2026-10-27T16:11:59.182Z","slug":"CVE-2015-20117","body":"## Overview\n\nNext Click Ventures RealtyScript 4.0.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create unauthorized user accounts and administrative users by crafting malicious forms. Attackers can submit hidden form data to /admin/addusers.php and /admin/editadmins.php endpoints to register new users with arbitrary credentials and escalate privileges to SUPERUSER level.\n\n## Affected\n\n- `RealtyScript 4.0.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}