PT-2026-20461 · Projectworlds · Online Time Table Generator

CVE-2025-70146 · Publicado 2026-02-18 · Atualizado 2026-02-18

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProjectWorlds Online Time Table Generator version 1.0

Description The software lacks authentication checks in several administrative action scripts located under the '/admin/' directory. This allows remote attackers to execute unauthorized administrative actions, such as adding or deleting records, by directly sending HTTP requests to affected API endpoints without a valid session. The affected API endpoints are under the '/admin/' directory. The vulnerable operations include adding records and deleting records.

Recommendations Apply authentication checks to all administrative action scripts under the '/admin/' directory.

Exploit

Correção

Missing Authentication

Missing Authorization

Enumeração de Fraquezas

CWE-306

CWE-862

Identificadores relacionados

CVE-2025-70146

Produtos afetados

Online Time Table Generator

Referências · 6

• 🔥 https://youngkevinn.github.io/posts/CVE-2025-70146-OTTTG-Unauth-Deletion · Exploit
• https://twitter.com/CVEnew/status/2024172401467019531 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-70146 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-70146 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2024206599334875239 · Publicação no Twitter
• https://projectworlds.com/online-time-table-generator-php-mysql · Nota