This vulnerability (CVE-2025-69170) is classified under CWE-98, indicating improper control of filenames used in PHP include or require statements, leading to a Local File Inclusion (LFI) vulnerability in ThemeREX Eventicity. It affects unauthenticated users and impacts Eventicity versions up to and including 1.5. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability allows an unauthenticated attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS score indicates a high impact on confidentiality, integrity, and availability, meaning the system's data and operations could be fully compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable application and monitor for suspicious activity. Avoid exposing the affected versions publicly where possible.