Vulnerability · Published Dec 5, 2025 · Assigned by VulnCheck
CVE-2020-36878ReQuest Serious Play F3 Media Player <= 3.0.0 Directory Traversal File Disclosure
High 8.7
In plain English
A high-severity security flaw in ReQuest Serious Play Media Player from ReQuest Serious Play LLC. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.4%top 68.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
ReQuest Serious Play Media Player 3.0 contains an unauthenticated file disclosure vulnerability when input passed through the 'file' parameter in and script is not properly verified before being used to read web log files. Attackers can exploit this to disclose contents of files from local resources.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ReQuest Serious Play LLC | ReQuest Serious Play Media Player | 3.0.02.1.0.8311.5.2.8221.5.2.8211.5.1.820 |
Weakness: CWE-73 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- Exploit Database Entry 48949 exploit
- Zero Science Advisory ZSL-2020-5599 vendor-advisory
- https://www.vulncheck.com/advisories/request-serious-play-f-media-player-directory-traversal-file-disclosure third-party-advisory