CVE-2020-36877

ReQuest Serious Play F3 Media Server <= 7.0.3 code execution

State: Published
Severity: 9.3 Critical
Published: Dec 5, 2025
Updated: Apr 7, 2026
Reserved: Dec 5, 2025

Description

ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands as the web server user. Attackers can upload PHP executable files via the Quick File Uploader page, resulting in remote code execution on the server.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
ReQuest Serious Play ProReQuest Serious Play LLC	7.0.3.4968Affected
ReQuest Serious PlayReQuest Serious Play LLC	7.0.2.4954Affected 6.5.2.4954Affected 6.4.2.4681Affected 6.3.2.4203Affected 2.0.1.823Affected

References

Exploit Database Entry 48952exploit
Vendor Security Advisory for ZSL-2020-5602vendor-advisory
Official Product Homepageproduct
https://www.vulncheck.com/advisories/request-serious-play-f-media-server-unauthenticated-rcethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.