RealtyScript 4.0.2 contains multiple time-based blind SQL injection vulnerabilities that allow unauthenticated attackers to extract database information by injecting SQL code into application parameters. This vulnerability has a high severity with a CVSS score of 8.8. Defenders should prioritize verifying and patching affected installations to prevent potential database information extraction. The CVE rec [truncated]
CVE-2015-20119 is a stored cross-site scripting vulnerability in RealtyScript 4.0.2. Authenticated attackers can inject malicious HTML and iframe elements through the text parameter in the pages.php admin interface. This vulnerability allows attackers to store malicious content that can be executed in the browsers of users viewing the affected pages. Defenders should prioritize verifying and remediating t [truncated]
CVE-2015-20118 is a stored cross-site scripting vulnerability in RealtyScript 4.0.2. An attacker can submit a POST request to the locations.php endpoint with a JavaScript payload in the location_name field to execute arbitrary code in an administrator's browser. This vulnerability can lead to code execution in administrator browsers, potentially resulting in data theft or unauthorized actions. Defenders s [truncated]
CVE-2015-20117 is a cross-site request forgery vulnerability in RealtyScript 4.0.2 that allows unauthenticated attackers to create unauthorized user accounts and administrative users. The vulnerability exists in the /admin/addusers.php and /admin/editadmins.php endpoints, enabling attackers to register new users with arbitrary credentials and escalate privileges to SUPERUSER level.
RealtyScript 4.0.2 is vulnerable to stored cross-site scripting via CSV file upload filenames. An attacker can inject malicious scripts through filename parameters in multipart form data, allowing for arbitrary JavaScript execution in users' browsers when the file is processed or displayed. This vulnerability affects RealtyScript 4.0.2 deployments, which may be exposed to potential cross-site scripting at [truncated]
CVE-2015-20115 is a stored cross-site scripting vulnerability in RealtyScript 4.0.2 that allows attackers to upload malicious scripts through the file POST parameter in admin/tools.php. The vulnerability has a CVSS score of 5.1 and is considered medium severity. Defenders should prioritize verifying the presence of this vulnerability in their RealtyScript installations and applying patches or mitigations [truncated]
