CVE-2015-20121 HIGH

CVE-2015-20121: RealtyScript 4.0.2 SQL Injection via u_id and agent Parameters

Vendor Next Click Ventures
Product RealtyScripts
Weakness CWE-89 · SQLi
Published March 15, 2026
Last update March 16, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Next Click Ventures RealtyScript 4.0.2 contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting arbitrary SQL code through the GET parameter 'u_id' in /admin/users.php and the POST parameter 'agent[]' in /admin/mailer.php. Attackers can exploit time-based blind SQL injection techniques to extract sensitive database information or cause denial of service through sleep-based payloads.

Key dates

02Disclosure timeline

March 15, 2026 CVE published
March 16, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-4724 itsourcecode Placement Management System student_profile.php sql injection CVE-2026-4826 SourceCodester Sales and Inventory System HTTP GET Parameter update_stock.php sql injection CVE-2024-9465 Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure CVE-2018-25407 eNdonesia Portal 8.7 SQL Injection via mod.php CVE-2024-4742 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.2.5 - Authenticated (Contributor+) SQL Injection