CVE-2015-20118

Name of the Vulnerable Software and Affected Versions RealtyScript version 4.0.2

Description RealtyScript 4.0.2 contains a stored cross-site scripting issue in the location name parameter of the admin locations interface. Attackers can submit POST requests to the ''locations.php'' endpoint with JavaScript payloads in the location name field, potentially executing arbitrary code in administrator browsers.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize the location name parameter before using it in the application.