PT-2026-20461 · Projectworlds · Online Time Table Generator

Published 2026-02-18 · Updated 2026-02-18 · CVE-2025-70146

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProjectWorlds Online Time Table Generator version 1.0

Description The software lacks authentication checks in several administrative action scripts located under the '/admin/' directory. This allows remote attackers to execute unauthorized administrative actions, such as adding or deleting records, by directly sending HTTP requests to affected API endpoints without a valid session. The affected API endpoints are under the '/admin/' directory. The vulnerable operations include adding records and deleting records.

Recommendations Apply authentication checks to all administrative action scripts under the '/admin/' directory.

Exploit

Fix

Missing Authentication

Missing Authorization

Weakness Enumeration

CWE-306

CWE-862

Related Identifiers

CVE-2025-70146

Affected Products

Online Time Table Generator

References · 6

• 🔥 https://youngkevinn.github.io/posts/CVE-2025-70146-OTTTG-Unauth-Deletion · Exploit
• https://osv.dev/vulnerability/CVE-2025-70146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-70146 · Security Note
• https://twitter.com/CVEnew/status/2024172401467019531 · Twitter Post
• https://twitter.com/TheHackerWire/status/2024206599334875239 · Twitter Post
• https://projectworlds.com/online-time-table-generator-php-mysql · Note