PT-2026-20462 · Projectworlds · Online Time Table Generator

CVE-2025-70147 · Publicado 2026-02-18 · Atualizado 2026-02-18

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ProjectWorlds Online Time Table Generator version 1.0

Description The application lacks proper authentication checks for specific administrative endpoints. This allows unauthenticated remote attackers to directly access sensitive information. The vulnerable endpoints are ''/admin/student.php'' and ''/admin/teacher.php''. Accessing these endpoints via direct HTTP GET requests without a valid session reveals sensitive data, including plaintext password field values.

Recommendations Implement authentication checks for access to the ''/admin/student.php'' endpoint. Implement authentication checks for access to the ''/admin/teacher.php'' endpoint.

Exploit

Correção

Missing Authentication

Missing Authorization

Enumeração de Fraquezas

CWE-306

CWE-862

Identificadores relacionados

CVE-2025-70147

Produtos afetados

Online Time Table Generator

Referências · 5

• 🔥 https://youngkevinn.github.io/posts/CVE-2025-70147-OTTTG-Info-Disclosure · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-70147 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-70147 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2024172402440110520 · Publicação no Twitter
• https://projectworlds.com/online-time-table-generator-php-mysql · Nota