---
id: CVE-2015-20116
title: RealtyScript 4.0.2 Stored Cross-Site Scripting via CSV File Upload Filename
summary: >-
  Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize CSV file
  uploads, allowing attackers to inject malicious scripts through filename
  parameters in multipart form data. Attackers can upload files with XSS
  payloads in the fi…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: Next Click Ventures
product: RealtyScript
affected:
  - RealtyScript 4.0.2
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-03-16T14:20:12.424083Z'
exploitAvailable: true
published: '2026-03-15'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T00:40:41.289Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2015-20116'
references:
  - url: 'https://www.exploit-db.com/exploits/38496'
    label: ExploitDB-38496
  - url: 'https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5269.php'
    label: Zero Science Lab Disclosure
  - url: >-
      https://www.vulncheck.com/advisories/realtyscript-stored-cross-site-scripting-via-csv-file-upload-filename
    label: >-
      VulnCheck Advisory: RealtyScript 4.0.2 Stored Cross-Site Scripting via CSV
      File Upload Filename
tags:
  - cve.org
  - exploit-available
epss: 0.00245
epssPercentile: 0.15668
ingestedAt: '2026-10-27T16:11:59.187Z'
---

## Overview

Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize CSV file uploads, allowing attackers to inject malicious scripts through filename parameters in multipart form data. Attackers can upload files with XSS payloads in the filename field to execute arbitrary JavaScript in users' browsers when the file is processed or displayed.

## Affected

- `RealtyScript 4.0.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.