CVE-2015-7715

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows remote attackers to hijack the authentication of administrators for requests that add a user via an add_user action to administrator/index.php.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/134067/Realtyna-RPL-8.9.2-CSRF-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
http://rpl.realtyna.com/change-logs/rpl7-changelogVendor Advisory
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5271.phpIssue Tracking, Third Party Advisory
https://www.exploit-db.com/exploits/38528/Exploit, Issue Tracking, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/134067/Realtyna-RPL-8.9.2-CSRF-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
http://rpl.realtyna.com/change-logs/rpl7-changelogVendor Advisory
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5271.phpIssue Tracking, Third Party Advisory
https://www.exploit-db.com/exploits/38528/Exploit, Issue Tracking, Third Party Advisory, VDB Entry

Timeline

Published: Oct 18, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-771610.0libstagefright in Android 5.x before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory cor CVE-2015-77179.3mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to gain privileges via a crafted application, aka CVE-2015-77185.0mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to cause a denial of service (process crash) via u CVE-2015-77237.8AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack.CVE-2015-77247.8AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomple CVE-2015-77256.5Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allow remote authenticat CVE-2015-77263.5Cross-site scripting (XSS) vulnerability in role deletion in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allow CVE-2015-77276.5Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allow remote a CVE-2015-77283.5Cross-site scripting (XSS) vulnerability in user creation in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_CVE-2015-77296.5Eval injection in test-net.xsjs in the Web-based Development Workbench in SAP HANA Developer Edition DB 1.00.091.00.1418659308 allows remote CVE-2015-773010.0SAP BusinessObjects BI Platform 4.1, BusinessObjects Edge 4.0, and BusinessObjects XI (BOXI) 3.1 R3 allow remote attackers to cause a denial CVE-2015-77315.5SAP Mobile Platform 3.0 SP05 ClientHub allows attackers to obtain the keystream and other sensitive information via the DataVault, aka SAP S