CVE-2020-36877

published 2025-12-05

CVE-2020-36877: ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands…

Priority P2 68 critical 9.3 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands as the web server user. Attackers can upload PHP executable files via the Quick File Uploader page, resulting in remote code execution on the server.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
request_serious_play_llc	request_serious_play	—	—
request_serious_play_llc	request_serious_play	—	—
request_serious_play_llc	request_serious_play	—	—
request_serious_play_llc	request_serious_play	—	—
request_serious_play_llc	request_serious_play	—	—
request_serious_play_llc	request_serious_play_pro	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78