This vulnerability in pebas CouponXxL involves deserialization of untrusted data, enabling object injection attacks. It affects all versions up to 3.0.0. The CVSS 3.1 base score is 9.8, reflecting that an unauthenticated attacker can remotely exploit this vulnerability without user interaction, resulting in high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker to execute arbitrary code or manipulate application logic through object injection, leading to full compromise of the affected system's confidentiality, integrity, and availability. Given the critical CVSS score and the nature of the vulnerability, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting deserialization functionality if possible or applying other protective controls recommended by the vendor once available. Monitor vendor channels for updates.