PT-2026-20462 · Projectworlds · Online Time Table Generator

Published 2026-02-18 · Updated 2026-02-18 · CVE-2025-70147

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ProjectWorlds Online Time Table Generator version 1.0

Description The application lacks proper authentication checks for specific administrative endpoints. This allows unauthenticated remote attackers to directly access sensitive information. The vulnerable endpoints are ''/admin/student.php'' and ''/admin/teacher.php''. Accessing these endpoints via direct HTTP GET requests without a valid session reveals sensitive data, including plaintext password field values.

Recommendations Implement authentication checks for access to the ''/admin/student.php'' endpoint. Implement authentication checks for access to the ''/admin/teacher.php'' endpoint.

Exploit

Fix

Missing Authentication

Missing Authorization

Weakness Enumeration

CWE-306

CWE-862

Related Identifiers

CVE-2025-70147

Affected Products

Online Time Table Generator

References · 5

• 🔥 https://youngkevinn.github.io/posts/CVE-2025-70147-OTTTG-Info-Disclosure · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-70147 · Security Note
• https://osv.dev/vulnerability/CVE-2025-70147 · Vendor Advisory
• https://twitter.com/CVEnew/status/2024172402440110520 · Twitter Post
• https://projectworlds.com/online-time-table-generator-php-mysql · Note