Vulnerability · Published Dec 5, 2025 · Assigned by VulnCheck

CVE-2020-36876ReQuest Serious Play F3 Media Server <= 7.0.3 Debug Log Disclosure2020

High 8.7

In plain English

A high-severity sensitive data in logs in ReQuest Serious Play from ReQuest Serious Play LLC. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 65.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ReQuest Serious Play F3 Media Server versions 7.0.3.4968 (Pro), 7.0.2.4954, 6.5.2.4954, 6.4.2.4681, 6.3.2.4203, and 2.0.1.823 allows unauthenticated attackers to disclose the webserver's Python debug log file containing system information, credentials, paths, processes and command arguments running on the device. Attackers can access sensitive information by visiting the message_log page.

Affected products (as reported)

Vendor	Product	Versions
ReQuest Serious Play LLC	ReQuest Serious Play Pro	7.0.3.4968
ReQuest Serious Play LLC	ReQuest Serious Play	7.0.2.49546.5.2.49546.4.2.46816.3.2.42032.0.1.823

Weakness: CWE-532 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

Exploit Database Entry 48950 exploit
Software Link product
Advisory URL vendor-advisory
https://www.vulncheck.com/advisories/request-serious-play-f-media-server-debug-log-disclosure third-party-advisory