CVE-2025-70146 Projectworlds CVE debrief

Who should care

Defenders responsible for ProjectWorlds Online Time Table Generator 1.0 deployments should assess exposure and prioritize mitigation to prevent unauthorized administrative operations.

Why it matters

CVE-2025-70146 is a critical vulnerability in ProjectWorlds Online Time Table Generator 1.0, allowing unauthorized administrative operations due to missing authentication. Defenders should prioritize verifying and mitigating exposure to prevent potential data tampering and system compromise.

• Verify and mitigate exposure to unauthorized administrative operations.
• Prevent potential data tampering and system compromise.
• Ensure authentication and session management for administrative operations.
• Monitor for anomalous activity and unauthorized access attempts.

Technical summary

CVE-2025-70146 is a critical vulnerability in ProjectWorlds Online Time Table Generator 1.0, allowing remote attackers to perform unauthorized administrative operations due to missing authentication in multiple administrative action scripts under /admin/. The vulnerability has a CVSS score of 9.1, indicating a high severity level. Defenders should prioritize verifying and mitigating exposure to prevent potential data tampering and system compromise. The affected product is ProjectWorlds Online Time Table Generator 1.0, and the vulnerability class is related to authentication and session management.

Defensive priority

Defenders should prioritize verifying and mitigating exposure to unauthorized administrative operations in ProjectWorlds Online Time Table Generator 1.0.

Recommended defensive actions

• Verify and inventory ProjectWorlds Online Time Table Generator 1.0 deployments for exposure.
• Restrict access to administrative endpoints under /admin/.
• Implement authentication and session management for administrative operations.
• Monitor for unauthorized administrative operations and anomalous activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its critical CVSS score of 9.1 and missing authentication in multiple administrative action scripts. The vulnerability allows remote attackers to perform unauthorized administrative operations, such as adding records and deleting records, via direct HTTP requests to affected endpoints without a valid session. The source-provided CVE metadata and official CVE Program record with source-provided CVE metadata are available for review. The official NIST NVD page

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.