CVE-2025-70147

HIGH 7.5CVE-2025-70147 · Published 18/02/2026 · updated 08/09/2026

Package	Affected versions	Patched versions
online time table generator projectworlds	`= 1.0`	No fix yet

Description

Missing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to obtain sensitive information (including plaintext password field values) via direct HTTP GET requests to these endpoints without a valid session.

References

0x0bito.github.io/posts/CVE-2025-70147-OTTTG-Info-Disclosure
projectworlds.com/online-time-table-generator-php-mysql · Product
youngkevinn.github.io/posts/CVE-2025-70147-OTTTG-Info-Disclosure · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free