What is the CVSS score of CVE-2020-36878?

CVE-2020-36878 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2020-36878?

Yes, a public proof-of-concept exploit is available for CVE-2020-36878. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2020-36878?

Within 24 hours: Identify and inventory all systems running ReQuest Serious Play Media Player 3.0 and isolate them from untrusted networks if business-critical. Within 7 days: Implement compensating controls including WAF rules to block file parameter exploitation and disable the affected script if operationally feasible. Within 30 days: Contact vendor for patch availability status, evaluate migration to alternative media player solutions, and conduct forensic review of access logs to determine if exploitation has occurred.

CVE-2020-36878

EUVD-2020-30826 HIGH

External Control of File Name or Path (CWE-73)

2025-12-05 disclosure@vulncheck.com

Information Disclosure

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 17:08 euvd

EUVD-2020-30826

Analysis Generated

Mar 15, 2026 - 17:08 vuln.today

PoC Detected

Dec 08, 2025 - 18:26 vuln.today

Public exploit code

CVE Published

Dec 05, 2025 - 18:15 nvd

HIGH 8.7

DescriptionCVE.org

ReQuest Serious Play Media Player 3.0 contains an unauthenticated file disclosure vulnerability when input passed through the 'file' parameter in and script is not properly verified before being used to read web log files. Attackers can exploit this to disclose contents of files from local resources.

AnalysisAI

A remote code execution vulnerability in and script is not properly verified (CVSS 8.7). Risk factors: public PoC available.

Technical ContextAI

Vulnerability type: remote code execution. CVSS 8.7 indicates high severity. Affects and script is not properly verified.

RemediationAI

Monitor vendor channels for patch availability.

CVE-2020-36878 vulnerability details – vuln.today

Back