CVE-2025-31084 describes a deserialization of untrusted data vulnerability in Sunshine Photo Cart (up to version 3.4.10). The vulnerability allows an attacker to perform object injection, which can lead to remote code execution or other severe impacts. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or mitigation details are currently available from the vendor or other sources.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code or manipulate application logic, resulting in complete compromise of the affected system's confidentiality, integrity, and availability. Given the critical CVSS score and the nature of object injection, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and monitor for suspicious activity. Avoid processing untrusted serialized data if possible.