This vulnerability in QRMenu Restaurant QR Menu Lite (<= 1.0.4) arises from unsafe deserialization of untrusted data, enabling an attacker to perform object injection. Exploitation can result in full compromise of the affected system's confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low complexity, required privileges, and high impact on all security properties. No patch or official fix has been documented yet, and the product is not a cloud service.

Successful exploitation allows an attacker with low privileges to execute object injection attacks remotely without user interaction, potentially leading to full system compromise including data breach, data manipulation, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application to trusted users only and monitor for suspicious activity related to deserialization processes. Avoid processing untrusted input where possible.