The vulnerability CVE-2025-49302 affects Scott Paterson Easy Stripe versions up to 1.1 and is characterized by improper control over code generation, leading to a remote code inclusion (code injection) flaw. This allows unauthenticated attackers to remotely execute arbitrary code on affected systems. The CVSS 3.1 vector indicates the attack requires no privileges or user interaction, has network attack vector, and results in complete compromise of confidentiality, integrity, and availability. No patch or official fix information is currently provided.

Successful exploitation of this vulnerability can lead to full system compromise, including unauthorized remote code execution with no required privileges or user interaction. This can result in complete loss of confidentiality, integrity, and availability of the affected system running Easy Stripe versions up to 1.1. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting network access to the affected application and monitoring for suspicious activity related to code injection attempts. Avoid deploying affected versions in production environments if possible.