This vulnerability is a PHP Object Injection issue in DesignSetGo versions up to 2.8.0. It arises from unsafe deserialization of untrusted data, classified under CWE-502. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or remediation information is provided in the source data.

Successful exploitation could lead to full system compromise, including arbitrary code execution, data disclosure, and service disruption. The attacker requires only low privileges and no user interaction, increasing the risk of exploitation. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to deserialization. Avoid processing untrusted serialized data where possible.