PT-2025-49271 · Unknown · Request Serious Play F3 Media Server

Published 2025-12-05 · Updated 2025-12-05 · CVE-2020-36877

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ReQuest Serious Play F3 Media Server version 7.0.3

Description The software contains an unauthenticated remote code execution issue. Attackers can upload PHP executable files through the Quick File Uploader page, leading to the execution of arbitrary commands as the web server user. The affected API endpoint is the Quick File Uploader page. The vulnerable parameter is the file uploaded through the Quick File Uploader page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-36877

Affected Products

Request Serious Play F3 Media Server

References · 6

• 🔥 https://exploit-db.com/exploits/48952 · Exploit
• https://zeroscience.mk/en/vulnerabilities/ZSL-2020-5602.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36877 · Security Note
• https://vulncheck.com/advisories/request-serious-play-f-media-server-unauthenticated-rce · Note
• http://request.com · Note
• https://twitter.com/CVEnew/status/1997000979103805808 · Twitter Post