CVE-2025-70147 ProjectWorlds CVE debrief

Who should care

Defenders responsible for deploying and managing ProjectWorlds Online Time Table Generator 1.0 should assess exposure and prioritize mitigation to prevent unauthorized access to sensitive information.

Why it matters

CVE-2025-70147 is a high-severity vulnerability in ProjectWorlds Online Time Table Generator 1.0, allowing remote attackers to obtain sensitive information due to missing authentication. Defenders should prioritize verifying and mitigating exposure to prevent potential unauthorized access and information disclosure.

• Potential unauthorized access to sensitive information
• Possible exposure of plaintext password field values
• Required verification of affected versions and deployment contexts
• Necessity for implementing authentication and authorization for sensitive endpoints

Technical summary

The ProjectWorlds Online Time Table Generator 1.0 is vulnerable to missing authentication, allowing remote attackers to obtain sensitive information, including plaintext password field values, via direct HTTP GET requests to /admin/student.php and /admin/teacher.php endpoints. This vulnerability enables unauthorized access to sensitive data due to the lack of proper authentication mechanisms. Defenders should prioritize verifying and mitigating exposure to prevent potential unauthorized access and information disclosure.

Defensive priority

Defenders should prioritize verifying and mitigating exposure to unauthenticated sensitive information disclosure in Online Time Table Generator 1.0.

Recommended defensive actions

• Verify and mitigate exposure to unauthenticated sensitive information disclosure in Online Time Table Generator 1.0
• Restrict access to /admin/student.php and /admin/teacher.php endpoints
• Implement authentication and authorization for sensitive endpoints
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry describe a missing-authentication issue in ProjectWorlds Online Time Table Generator 1.0, allowing remote attackers to obtain sensitive information via direct HTTP GET requests.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.