CVE-2015-20121

This vulnerability allows attackers to secretly access and extract sensitive information from the database of RealtyScript by sending specially crafted requests, even without logging in. They can do this by measuring how long it takes the system to respond, which reveals data one piece at a time.

This vulnerability allows an attacker with a valid account to inject harmful HTML and iframe code into the RealtyScript admin interface, which can then execute in the browsers of users who visit affected pages. To exploit this, the attacker must submit a specially crafted request while logged in, enabling them to store and display malicious content to other users.

This vulnerability allows an attacker to run malicious JavaScript code in the browsers of administrators by submitting specially crafted data through the admin locations interface. To exploit this, the attacker needs access to the locations.php endpoint and must input harmful scripts into the location_name field.

This vulnerability allows attackers to create unauthorized user accounts, including administrative ones, by tricking users into submitting malicious forms. It requires no authentication, meaning anyone can exploit it simply by sending specially crafted requests to the system's user management endpoints.

This vulnerability allows attackers to upload files with malicious scripts hidden in the filenames, which can then run harmful JavaScript in users' browsers when the files are viewed. It occurs because the system does not properly check or clean the filenames in the uploaded files, making it easy for attackers to exploit this weakness.