What is the CVSS score of CVE-2025-68015?

CVE-2025-68015 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Vollstart Event Tickets are affected by CVE-2025-68015?

A critical code injection vulnerability (CVE-2025-68015, CVSS 9.0) affects the Vollstart Event Tickets Scanner application, allowing attackers to execute arbitrary code with system-level privileges.

How to fix or mitigate CVE-2025-68015?

Within 24 hours: Identify all systems running Vollstart Event Tickets with Ticket Scanner and isolate them from production networks if possible; disable public-facing access to the ticketing application and restrict to VPN/internal networks only. Within 7 days: Implement WAF rules to block injection payloads targeting the vulnerable component; conduct forensic logs review for signs of exploitation; engage Vollstart for patch timeline and temporary workarounds. Within 30 days: Apply vendor patch immediately upon release; perform full security assessment of affected systems; review and strengthen code injection defenses across all ticket processing functions.

Vollstart Event Tickets CVE-2025-68015

CRITICAL

Code Injection (CWE-94)

2026-01-22 audit@patchstack.com

Code Injection RCE

9.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 22, 2026 - 17:16 nvd

CRITICAL 9.0

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Code Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.8.3.

AnalysisAI

Event Tickets with Ticket Scanner WordPress plugin has a code injection vulnerability allowing remote code execution through the event management system.

Technical ContextAI

The Event Tickets with Ticket Scanner plugin by Vollstart has a CWE-94 code injection vulnerability that allows attackers to inject and execute arbitrary code through the ticket management functionality.