CVE-2015-20120: Nextclickventures Realtyscript

Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Next Click Ventures RealtyScript 4.0.2 contains multiple time-based blind SQL injection vulnerabilities that allow unauthenticated attackers to extract database information by injecting SQL code into application parameters. Attackers can craft requests with time-delay payloads to infer database contents character by character based on response timing differences.

Affected products

Published 2026-03-16. Last modified 2026-06-17.