What is the CVSS score of CVE-2015-20119?

CVE-2015-20119 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2015-20119?

Organizations using Next Click Ventures RealtyScript 4.0.2 should be aware of moderate risk from CVE-2015-20119, a cross-site scripting vulnerability rated CVSS 6.4.

Is there a public PoC exploit available for CVE-2015-20119?

Yes, a public proof-of-concept exploit is available for CVE-2015-20119. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2015-20119?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2015-20119

EUVD-2015-9419 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-15 VulnCheck

PHP XSS Realtyscript

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 15, 2026 - 20:00 euvd

EUVD-2015-9419

Analysis Generated

Mar 15, 2026 - 20:00 vuln.today

CVE Published

Mar 15, 2026 - 18:34 nvd

MEDIUM 6.4

DescriptionCVE.org

Next Click Ventures RealtyScript 4.0.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious HTML and iframe elements through the text parameter in the pages.php admin interface. Attackers can submit POST requests to the add page action with crafted iframe payloads in the text parameter to store malicious content that executes in the browsers of users viewing the affected pages.

AnalysisAI

RealtyScript 4.0.2 contains a stored cross-site scripting (XSS) vulnerability in the pages.php admin interface that allows authenticated attackers to inject malicious HTML and iframe elements through the text parameter. Attackers can craft POST requests to store malicious content that executes in the browsers of users viewing affected pages. A public proof-of-concept exploit exists (Exploit-DB 38496), making this vulnerability actively exploitable by authenticated threat actors.

Technical ContextAI

The vulnerability is a stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in RealtyScript, a PHP-based real estate management application. The root cause is insufficient input validation and output encoding of the 'text' parameter in the pages.php administrative interface. The application fails to sanitize HTML and iframe elements before storing user-supplied input in the backend database, and does not properly encode output when rendering stored content. This allows attackers to inject arbitrary JavaScript code and iframe elements that persist in the application database and execute in the context of other users' browsers with the same origin.

RemediationAI

Immediate remediation steps: (1) Apply input validation and sanitization to the 'text' parameter in pages.php — use a whitelist approach to allow only safe HTML tags and attributes, or strip all HTML entirely if rich text is not required; (2) Implement proper output encoding using context-aware escaping (e.g., HTML entity encoding) when rendering stored content to prevent script execution; (3) Deploy a Content Security Policy (CSP) header to restrict inline script execution; (4) Upgrade to a patched version if available from Next Click Ventures (no specific patched version identified in references; contact vendor at https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5269.php or https://www.vulncheck.com/advisories/realtyscript-stored-cross-site-scripting-via-text-parameter-in-pages-php for advisory details); (5) As a temporary workaround, restrict administrative access to trusted users only and conduct regular audits of stored page content for malicious payloads; (6) Consider migrating to actively maintained alternatives if vendor support is unavailable.