CVE-2025-70147CWE-306CWE-862broken-access-control

CVE-2025-70147

High · published February 18, 2026

CVSS v3.1

7.5

EPSS

Percentile

46.9

In the wild

Unconfirmed

What it is

Missing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to obtain sensitive information (including plaintext password field values) via direct HTTP GET requests to these endpoints without a valid session.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00579 · 46.9th percentile
Weaknesses: CWE-306 · Missing Authentication for Critical Function; CWE-862 · Missing Authorization
Published: 2026-02-18T22:21Z

Affected products (1)

Product	Versions	Fixed in
projectworlds/online_time_table_generator	all versions	—

References (3)

https://0x0bito.github.io/posts/CVE-2025-70147-OTTTG-Info-Disclosure/ · [email protected]https://projectworlds.com/online-time-table-generator-php-mysql/ · [email protected]https://youngkevinn.github.io/posts/CVE-2025-70147-OTTTG-Info-Disclosure/ · [email protected]

EPSS history

Timeline

18 FEB 00:00Z
Missing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to obtain…
cvelistv5