A PHP Object Injection vulnerability exists in Dynamic QR Code – generator versions up to and including 1.0.1. This flaw allows an attacker with limited privileges to execute arbitrary code or cause denial of service by injecting crafted PHP objects.