CVE-2020-36877CWE-78

ReQuest Serious Play F3 Media Server <= 7.0.3 code execution

Critical · published December 5, 2025

CVSS v4.0
9.3
EPSS
1%
Percentile
53.4
In the wild
Unconfirmed
What it is

ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands as the web server user. Attackers can upload PHP executable files via the Quick File Uploader page, resulting in remote code execution on the server.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00718 · 53.4th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-12-05T17:16Z
EPSS history
Timeline
  • 05 DEC 17:16Z
    ReQuest Serious Play F3 Media Server <= 7.0.3 code execution
    cvelistv5