CVE-2025-70147 ProjectWorlds CVE debrief

Who should care

Defenders responsible for ProjectWorlds Online Time Table Generator 1.0 deployments should assess exposure and prioritize mitigation to prevent unauthenticated sensitive information disclosure.

Why it matters

CVE-2025-70147 is a high-severity vulnerability in ProjectWorlds Online Time Table Generator 1.0 that allows remote attackers to obtain sensitive information via direct HTTP GET requests. Defenders should prioritize verifying and mitigating exposure to prevent potential information disclosure and unauthorized access.

• Potential exposure of sensitive information, including plaintext password field values
• Risk of unauthorized access to administrative interfaces
• Need for verification of affected versions and deployments
• Priority for implementing proper authentication and authorization

Technical summary

The ProjectWorlds Online Time Table Generator 1.0 is vulnerable to unauthenticated sensitive information disclosure due to missing authentication in /admin/student.php and /admin/teacher.php endpoints. This vulnerability, with a CVSS score of 7.5, allows remote attackers to obtain sensitive information, including plaintext password field values, via direct HTTP GET requests. Defenders should prioritize verifying and mitigating exposure to prevent potential information disclosure and unauthorized access. Implementing proper authentication and authorization for administrative interfaces is crucial to mitigate this vulnerability.

Defensive priority

Defenders should prioritize verifying and mitigating exposure to unauthenticated sensitive information disclosure in ProjectWorlds Online Time Table Generator 1.0.

Recommended defensive actions

• Verify and mitigate exposure to unauthenticated sensitive information disclosure in ProjectWorlds Online Time Table Generator 1.0
• Restrict access to /admin/student.php and /admin/teacher.php endpoints
• Implement proper authentication and authorization for administrative interfaces
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.5 and the CWE-306 and CWE-862 weaknesses. The vulnerability was publicly disclosed on 2026-02-18T17:21:36.007Z. The NVD entry and CVE Program record offer source-provided CVE metadata and official vulnerability assessment. Additional information may be found in source references, including product details and potential exploit, mitigation, and third-party advisory information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.